Vulnerabilities
Opt-in daily match of installed versions against Stalza’s live vulnerability API, with local fixture fallback.
What it does
Builds an inventory of core, plugins, and themes. When you opt in, sends that inventory to Stalza’s match service and shows advisories for vulnerable versions. Results are cached on your site.
How it works
Off by default — no outbound requests until opt-in. On refresh (manual or daily cron), the plugin posts your inventory to stalza.com and stores matches with source live when the cloud responds.
If the live API is unreachable, or when STALZA_SEC_VULN_FIXTURE is enabled (tests/local), the plugin uses a local fixture instead. Staging sites can point at another API with the stalza_sec_vuln_match_url filter.
Settings
- Allow vulnerability matching — Settings tab (explicit opt-in)
What findings mean
Kind vuln.advisory with severity and advisory link when available. Stale badge when cache is older than 48 hours. The Vulnerabilities tab shows whether the last refresh came from Stalza cloud, a local fixture, or not yet refreshed.
Recommended action
Update the affected component. Re-run match after upgrades.