Skip to main content
Metrics type: Key Metrics • Category: Ecommerce Platform
WP plugin with a publicly-disclosed security update unapplied for >7d. CVEs get exploited within days of disclosure, patch immediately.

​
At a glance

Real-time alert when an installed WordPress / WooCommerce plugin has a publicly-disclosed security patch that has been unapplied for more than 7 days. CVEs are typically exploited within days of disclosure.

​
Calculation

Calculated automatically from your WooCommerce data. See the At a glance summary above for what the metric tracks and the worked example below for a typical reading.

​
Worked example

A self-hosted UK fashion brand running 47 plugins. Polled 12 Apr 26. The card fires with 2 plugins listed. Three observations:
  1. Self-hosted variance is the recurring theme on Woo. This brand has the merchant manually applying plugin updates monthly. Two CVEs exceeded the 7-day grace window before the next maintenance cycle. On managed-Woo (Pressable, WP Engine), Elementor and Yoast would have auto-updated within 24-48 hours of patch release. WordPress.com auto-updates all plugins.
  2. Plugin-induced data shape variance: detection depends on accurate version reporting. Some commercial plugins (e.g. ACF Pro, Gravity Forms) report the version through their licensing API rather than wp/v2/plugins. The Vortex IQ engine reads the WP REST API; license-only plugins can show stale versions. Check Plugin Outdated for the broader version-drift view.
  3. The Elementor CVE in this scenario is a real pattern. Elementor has shipped 6+ critical CVEs in 2024-2025; merchants running unpatched Elementor are a known target for ecommerce skimmer injection. Vortex Mind investigates in SSL Status and integrates with cards like Plugins Outdated for the broader stack-health view.

​
Sibling cards merchants should reference together

​
Reconciling against the vendor’s own dashboard

Where to look in WooCommerce / WordPress Admin: WP Admin → Plugins shows the plugin list with update notifications. WP Admin does not flag which updates are security patches; you have to read the changelog. Vortex IQ surfaces the security-relevant subset by cross-referencing WPScan / Patchstack feeds. Why our alert may differ from WP Admin update notifications: Cross-connector reconciliation:

​
Known limitations / merchant FAQs

Self-hosted vs managed-Woo, how does it affect this alert? Self-hosted: you own all patching. Expect this alert to fire occasionally unless you have automated updates on. Managed-Woo: critical CVEs auto-patched within hours, less critical may take days. WordPress.com Business / Commerce: all updates auto-applied, this alert rarely fires. Status-filter selection, why exclude low-severity? Low-severity CVEs (XSS in admin-only views, info-disclosure in obscure features) rarely lead to ecommerce skimming or data theft. The signal-to-noise ratio is too low to alert on. They are visible in Plugins Outdated. Refund-object accounting? Not applicable to this alert. Plugin-induced data shape variance, what plugins are blind spots?
  • Commercial plugins distributed via licensing servers (ACF Pro, Gravity Forms, WP Rocket, some Yoast paid extensions): version reporting can lag.
  • Custom in-house plugins: not in the WPScan / Patchstack feeds; security state unknown.
  • “Premium” forks of free plugins: tracked under the parent plugin slug if recognised.
Multi-currency, does it affect this alert? No, currency-independent. Why does Woo and Stripe disagree? Stripe does not track plugin security; the metrics are unrelated. Today is jumpy, why? Alert is stable, no daily drift. New CVEs appear and trip the alert exactly once per plugin until patched. Sync-lag from self-hosted server slowness, can it cause false alerts? The indexer reads installed plugin versions hourly. A 1-2 hour outage delays the alert clearing after a patch is applied; not a false positive. My WP Admin says all plugins are up-to-date, why is the alert firing?
  1. Hard-refresh WP Admin (sometimes the WP transients cache stale update info).
  2. Check the WPScan / Patchstack entry for the named plugin and confirm the CVE is real.
  3. Verify the installed version on disk matches what WP Admin reports (commercial plugins sometimes lie).
  4. If genuinely up-to-date, contact support; the CVE feed may have stale data.

​
Tracked live in Vortex IQ Nerve Centre

Plugin Security-Patch Breach is one of hundreds of KPI pulses Vortex IQ tracks across WooCommerce and 70+ other ecommerce connectors. Nerve Centre runs the detection layer; Vortex Mind investigates the cause when something moves; Ask Viq lets you interrogate any number in plain English. Start for free or book a demo to see this metric running on your own data.