Glen Scott

@carax If you click on “Settings” in the left hand admin menu, then click “Plugin Security Scanner”, you’ll find the page where you can enter your API token.

Because of changes made to the vulnerability database that this plugin uses, you will now need to register for an API key here:

https://wpvulndb.com/users/sign_up

If you have done this and added your key details to the plugin, you will be allowed 50 requests to the database per day. A request is made for each plugin and theme that you have installed on your website (plus one request for WordPress itself).

If you update your Scanner to v2.0.2 do you still get this message?

By default, the scanner should run one per day via the WordPress cron system. The vulnerability database has a restriction on 50 free calls per day. If your site has a lot of plugins and themes installed, then you may hit this limit. If you have several installs, it might be worthwhile registering for additional API keys so that each site has its own API key (and therefore limit).

Thank you for being so responsive. Appreciate it.

Hi Jeff,

Thanks for replying. The reason I ask about this approach is that it worked as expected in version 6 (albeit with a template named login-form.php rather than login.php). I was expecting the same approach to work with version 7 but you are saying this is not the case?

Glen

I’m tempted to put this down as a temporary connection issue between your server and the WPVulnDB server (wpvulndb.com).

I’ll leave this support topic open in case you experience it again.

The most recent version of my plugin allows you to ignore unpatched issues such as the DoS one you mention.

No feedback, so closing as resolved.

Hi George,

The WPScan database has now been updated:

https://wpvulndb.com/vulnerabilities/8958
> fixed in version 2.5.13

This should prevent these alerts happening for you.

Kind regards,

Glen

Hi George,

This is likely a false alarm, but I am going to check with the person that maintains the WPScan vulnerability site (which the plugin uses).

Stay tuned.

Glen

It is not currently listed as a vulnerability in 4.9:

https://wpvulndb.com/wordpresses

This means that either WordPress has fixed the issue or the vulnerability database has not yet been updated.

The email will only be sent out if vulnerabilities are found. If nothing is found, no email will be sent.

The time depends on when you installed and activated plugin — it will run approximately 24 hours after that. The time cannot be set currently.

Great suggestion! It will be relatively simple for me to add a custom hook to allow you to customise to email address, so I’ll add that feature to the next version of the plugin.

I’m sorry you are experiencing issues with the plugin. Can you elaborate what you mean by “not add links”, as this plugin doesn’t add links, but rather a new column in the user list.