CodeMedic SupplyScope

CodeMedic SupplyScope detects vulnerable Composer packages bundled within your WordPress plugins. Every hour, it scans your active plugins against a continuously updated CVE intelligence feed and displays the results in a clear admin dashboard. Stop guessing which plugins have unpatched vulnerabilities. Get visibility into the hidden dependency chain of every plugin on your site. How It Works

1. Discovery — Every hour, the plugin scans all active WordPress plugins for bundled Composer dependencies and checks them against our cloud CVE API.
2. Review — Detected vulnerabilities are listed in the admin screen with CVE details, severity, and affected library information.
3. Act — The plugin reports what's vulnerable so you can take action — whether that means updating the plugin, replacing it, or applying patches manually.

Why Dependency Scanning? WordPress plugins often bundle Composer dependencies (Guzzle, Monolog, PHPUnit, etc.) directly in their vendor directory. Plugin authors may not update these dependencies promptly after a CVE is disclosed. Without a scanner, you have no visibility into these hidden risks. Patchstack and Wordfence block exploit attempts at the perimeter. This plugin tells you what's vulnerable so you can take action — whether that means updating the plugin, replacing it, or applying patches manually.

1.0.0

• Initial release.
• Hourly scanning of active plugins for bundled Composer dependencies.
• Cloud-based CVE intelligence feed.
• Read-only vulnerability dashboard with CVE details and severity.
• Patch history log.
• Patch history log for audit and manual remediation.