IGW Security History

IGW Security History provides information about the security history of the plugins installed on your WordPress site. The plugin builds a local inventory of installed plugins and combines this information with known vulnerability data. For each plugin, it can show:

• Plugin name and installed version.
• Whether the plugin is active or inactive.
• Whether the plugin is available on WordPress.org.
• Whether the plugin appears to be commercial or external.
• Total number of known historical vulnerabilities.
• Vulnerabilities grouped by severity: critical, high, medium, low or unknown.
• Date of the most recently known vulnerability.
• Whether the currently installed version is affected by known vulnerabilities.

This makes it possible to distinguish between a plugin that has had security issues in the past and a plugin whose currently installed version is actually affected by a known vulnerability. For example, a plugin may have dozens of historical vulnerabilities while its current version has no known vulnerabilities affecting it. Plugin inventory IGW Security History maintains a local inventory containing information about the plugins detected on the WordPress installation. The inventory includes information such as the plugin slug, main file, installed version, activation status, detected source and the dates when the plugin was first and last detected. This information is stored in custom WordPress database tables. WordPress.org availability The plugin checks whether installed plugins are currently available from the official WordPress.org plugin directory. It can distinguish between plugins found on WordPress.org and plugins detected as commercial or external. A plugin not currently found on WordPress.org is reported as unavailable. This does not necessarily mean that the plugin was removed from the directory, since it may be a commercial, private or custom plugin that was never hosted there. Vulnerability history IGW Security History retrieves a summarized vulnerability history for detected plugins. The information includes:

• Total known vulnerabilities.
• Critical vulnerabilities.
• High severity vulnerabilities.
• Medium severity vulnerabilities.
• Low severity vulnerabilities.
• Vulnerabilities without a known severity.
• Most recently published known vulnerability.

Historical vulnerability information does not mean that the currently installed version is vulnerable. Installed version check In addition to the historical information, IGW Security History compares the currently installed plugin version against the affected version ranges contained in the vulnerability database. This allows the plugin to report separately whether known vulnerabilities affect the version currently running on the site. When no matching vulnerability is found, the plugin reports that there are no known vulnerabilities affecting that version according to the currently available vulnerability data. Detailed security history Each detected plugin can be reviewed individually from the IGW Security History administration screen. The detailed view provides a complete overview of the known vulnerability history for that plugin, including:

• Historical vulnerability totals grouped by severity.
• Security status of the currently installed version.
• A chronological vulnerability timeline.
• Individual vulnerability details, including CVE identifiers when available, severity, CVSS score, publication date and affected version ranges.
• Information about patched versions when available.

The vulnerability timeline provides a visual representation of the plugin's security history over time. Each point represents a known vulnerability and its position indicates its publication date and severity. Points can be selected to navigate directly to the corresponding vulnerability information. When an installed version is being evaluated, the detailed view distinguishes vulnerabilities that affect that specific version from vulnerabilities that only form part of the plugin's historical record. Plugins screen integration Security information is also displayed directly on the standard WordPress Plugins screen. Depending on the available information, IGW Security History can display:

• WordPress.org availability or detected external/commercial origin.
• Whether the installed version has known vulnerabilities.
• A summary of the plugin's historical vulnerabilities.

A security history link provides access to the detailed plugin information directly from the Plugins screen. The detailed security history can be displayed in a modal window without leaving the standard WordPress Plugins screen. Manual updates The administration screen provides controls to refresh the plugin inventory and vulnerability information. Vulnerability checks are performed in batches to reduce the number of external requests.

1. Upload the igw-security-history folder to the /wp-content/plugins/ directory, or install the plugin through the WordPress Plugins screen.
2. Activate IGW Security History from the Plugins screen.
3. Open the IGW Security History administration screen.
4. Run the plugin analysis to build the local plugin inventory.
5. Update the vulnerability information to retrieve the current security history.

No external account or API key is required.

0.1.0

• Initial release.
• Added local inventory of installed plugins.
• Added plugin activation and installation status tracking.
• Added WordPress.org availability checks.
• Added detection of WordPress.org, commercial and external plugin sources.
• Added historical vulnerability information.
• Added vulnerability severity classification.
• Added checks against the currently installed plugin version.
• Added batch vulnerability queries.
• Added detailed security history for individual plugins.
• Added chronological vulnerability timeline.
• Added navigation between timeline events and vulnerability details.
• Added vulnerability information to the standard WordPress Plugins screen.
• Added detailed security history modal to the standard WordPress Plugins screen.
• Added administration interface for reviewing plugin security information.
• Added cleanup of plugin data on uninstall.