A plugin or theme has a known vulnerability

SeverityHigh

ScopeWhole site

EffortMedium

Verified bySecurity scan (weekly, or Re-scan)

Rule keysec_plugin_vulnerable

Short answer

At least one plugin or theme your pages load runs a version listed as vulnerable in Wordfence Intelligence. The issue lists each one with its CVE, CVSS score and fixed version. Update them; if no fixed version exists, deactivate and delete the plugin and replace it.

Why it matters

Plugins and themes are the most common way into WordPress sites. Flaws such as unauthenticated file upload, SQL injection or privilege escalation are exploited in bulk within days of being published, because the affected version is easy to detect from the outside, exactly as Glimana does here. A successful attack usually ends in spam pages, redirects or a new admin account, followed by "This site may be hacked" warnings in Google results.

How Glimana detects it

On WordPress sites Glimana takes the plugin and theme folder names from /wp-content/plugins/… and /wp-content/themes/… addresses on your home page and two sample pages. The version comes from the ?ver= value on those files (ignored when it equals the WordPress version), otherwise from the plugin's readme.txt Stable tag or the theme's style.css Version (at most eight such files per scan). Each version is matched against the affected ranges in Wordfence Intelligence; the severity is that of the most serious match (Wordfence rating, or CVSS 9+ critical, 7+ high, 4+ medium). Plugins that load nothing on these pages, and those whose version cannot be read, are not judged. Before the vulnerability data has loaded, the check shows Not running yet. Vulnerability data: Wordfence Intelligence, © Defiant, Inc.

How to fix it

Watch out

A deactivated plugin is still on the server and its files can still be attacked directly: delete it, do not just deactivate it. A plugin closed on WordPress.org will never get a fix. The Stable tag in readme.txt is what the author declared, so compare the version shown under Plugins before concluding the finding is wrong.

Find the finding in Glimana. Open Security; this check is in the Outdated software group, with the evidence from the last scan under its title. The same problem is listed under Issues › A plugin or theme has a known vulnerability.
Apply the fix on your platform.

WordPress dashboardManaged hostingWP-CLI

Open Dashboard › Updates or Plugins › Installed Plugins and click Update now for each listed plugin; themes are under Appearance › Themes. Turn on Enable auto-updates for plugins you trust. For premium plugins and themes, update through the vendor's licence or download the new version from your account there.

Some hosts manage or block plugin updates, or keep their own copy of popular plugins. Use the host's update tool or ask support to update the listed slugs to at least the fixed version shown in the issue.

List versions with wp plugin list --fields=name,status,version,update_version, then run wp plugin update <slug> or wp theme update <slug>. To remove a plugin with no fix: wp plugin deactivate <slug> && wp plugin delete <slug>.
Check it in Glimana. Press Re-scan on the Security page (up to two scans an hour) or wait for the weekly scan on Sunday; the problem closes when the check passes.

How the fix is verified

After the fix, press Re-scan on the Security page (or wait for the weekly Sunday 04:00 scan); the problem closes when the check passes.