> ## Documentation Index > Fetch the complete documentation index at: https://docs.vortexiq.ai/llms.txt > Use this file to discover all available pages before exploring further. # Plugins Out-of-Date, WooCommerce > Active plugins with available updates (esp. security-tagged). Stale plugin versions are top-3 cause of WC store breakages, feeds audit WC02... How to read... **Metrics type:** [Key Metrics](/nerve-centre/overview#metrics-types-explained) • **Category:** [Ecommerce Platform](/nerve-centre/connectors#connectors-by-type) > Active plugins with available updates (esp. security-tagged). Stale plugin versions are top-3 cause of WC store breakages, feeds audit WC02 finding. ## At a glance > Count of active WordPress / WooCommerce plugins with available updates, with the security-tagged subset highlighted. Stale plugin versions are a top-3 cause of WC store breakages. | | | | --------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **What it counts** | `COUNT(plugins WHERE installed_version < latest_version AND active = true)`. The "outdated" set, not just the security-critical subset (which is [Plugin Security Breach](/nerve-centre/kpi-cards/woocommerce/plugin-security-patch-breach)). | | **REST API endpoint** | `GET /wp-json/wp/v2/plugins`, requires `manage_options` capability. Cross-referenced against WP plugin directory and commercial plugin update servers where available. | | **VAT / tax / shipping / discounts** | Not applicable, stack health. | | **Status filter** | Only `active` plugins. Deactivated plugins are not counted (they are not running, no risk). | | **Refunds / cancelled / failed orders** | Not applicable. | | **Currency** | Not applicable. | | **Channels / sources** | Affects entire WP install. | | **Self-hosted vs managed-Woo** | Self-hosted: typically 8-15 outdated plugins on average. Managed-Woo: typically 0-3 (auto-update on critical / minor releases). WordPress.com: typically 0. The card is most useful for self-hosted merchants. | | **Time window** | `RT` (polled hourly) | | **Alert trigger** | `>3` plugins with security update available; sentiment\_key `stack_health` | | **Roles** | owner, operations | ## Calculation Calculated automatically from your WooCommerce data. See the At a glance summary above for what the metric tracks and the worked example below for a typical reading. ## Worked example A self-hosted UK fashion brand running 47 active plugins. Polled 12 Apr 26. | Bucket | Count | Note | | -------------------------------- | ----- | -------------------------- | | All active plugins | 47 | | | Outdated (any update available) | 14 | 30% of stack | | Outdated with security tag (CVE) | 4 | Trips alert (>3 threshold) | | Outdated minor releases (no CVE) | 10 | Listed but does not alert | Three observations: 1. **Self-hosted variance is the recurring theme.** This brand runs \~30% of plugins behind on updates. Managed-Woo equivalents (same plugin set on Pressable or WP Engine) typically sit at 5-10% because the host pushes minor / security updates automatically. The 30% figure is normal for self-hosted Woo run by a non-technical owner; lower (5-10%) for self-hosted Woo with a maintenance contract; higher (50%+) for stores nobody is actively maintaining. 2. **The 14-outdated count masks 4 critical risks.** The merchant sees "14 plugins behind" and feels it is too overwhelming to tackle. Vortex IQ surfaces the security-tagged 4 separately so the actionable subset is obvious. Pair with [Plugin Security Breach](/nerve-centre/kpi-cards/woocommerce/plugin-security-patch-breach) for the urgent list. 3. **Plugin-induced data shape variance: commercial plugins.** ACF Pro, Gravity Forms, WP Rocket, Yoast Premium, and similar use their own update servers. The Vortex IQ engine attempts to read these via the WP REST API; if the licence is expired the version still resolves but the "latest" comparison breaks. A persistent count of 1-2 stale-licence plugins is normal for stores with lapsed paid plugins. ## Sibling cards merchants should reference together | Card | Why pair it with Plugins Outdated | | --------------------------------------------------------------------------------------------------- | -------------------------------------------------------------- | | [WC Plugin Security Breach Alert](/nerve-centre/kpi-cards/woocommerce/plugin-security-patch-breach) | The urgent subset. Outdated does not always mean vulnerable. | | [WC Active Plugin Count](/nerve-centre/kpi-cards/woocommerce/active-plugin-count) | The denominator. 14 outdated of 47 is different from 14 of 12. | | [WC SSL Status](/nerve-centre/kpi-cards/woocommerce/ssl-https-status) | Companion stack-health card. | | [WC WC Core Version](/nerve-centre/kpi-cards/woocommerce/woocommerce-core-version) | WooCommerce core itself. | | [WC WP Core Version](/nerve-centre/kpi-cards/woocommerce/wordpress-core-version) | WordPress core. | ## Reconciling against the vendor's own dashboard **Where to look in WordPress Admin:** [WP Admin → Dashboard → Updates](/wp-admin/update-core.php) shows the canonical update list. WP Admin does not separate "any update" from "security update"; this card does. **Why our count may differ from WP Admin:** | Reason | Direction | | ------------------------------------------------------------------------------------------------------- | ---------------- | | **Time-zone**. CVE feeds and update timestamps in UTC; WP Admin in WP-site timezone. | Boundary effects | | **Self-hosted server uptime**. Hourly indexer poll lag if outage. | Self-resolves | | **Plugin-version compatibility**. Commercial plugins via licensing servers may report stale versions. | Either | | **Auto-update plugins**. Some plugins silently auto-update; alert clears once next poll runs. | Self-resolves | | **WP transients cache**. WP Admin caches update info for up to 12 hours; this card uses live REST data. | Ours fresher | **Cross-connector reconciliation:** | Card | Expected relationship | | -------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------- | | [`website.security_headers`](/nerve-centre/website_performance/security_headers) | Outdated plugins correlate with weaker security headers (admins postpone all security work together). | ***
Same-metric documentation cross-reference This is a Woo-specific (WordPress-specific) card. Shopify and BigCommerce do not have a plugin-update concept the same way; closest analogue is Shopify app version reporting (no equivalent Vortex IQ card yet).
## Known limitations / merchant FAQs **Self-hosted vs managed-Woo, why does it matter so much?** Self-hosted owners patch on their own schedule (often monthly or quarterly). Managed-Woo and WordPress.com auto-patch. The structural difference is the single biggest driver of stack-health divergence between Woo merchants. **Status-filter selection, why exclude inactive plugins?** Inactive plugins do not run code, so they cannot be exploited. Counting them would noise the alert. Note: deactivated plugins still sit on disk and could theoretically be re-activated by an attacker who has filesystem access; if you are not using a plugin, delete it rather than deactivate it. **Refund-object accounting?** Not applicable. **Plugin-induced data shape variance, what is fragile in detection?** * Commercial plugins via licensing servers (ACF Pro, Gravity Forms, WP Rocket, Yoast Premium): version reads but "latest" comparison can break with expired licences. * Custom plugins: not in any update channel; always shown as "current". * Plugins with non-standard slugs or readme.txt: occasionally not matched against the WP directory. **Multi-currency, does it affect this card?** No. **Why does Woo and Stripe disagree?** Stripe does not track plugins. **Today is jumpy, why?** Stable over time. Counts move when plugins release updates or when the merchant patches. **Sync-lag from self-hosted server slowness?** Hourly poll; brief outages delay updates by 1-2 hours. **My WP Admin shows fewer updates, debug?** 1. Hard-refresh WP Admin to bypass WP transients cache. 2. Force a "Check again" in `Dashboard → Updates`. 3. Verify commercial plugin licences are valid. 4. If gap remains > 24 hours, contact support. *** ### Tracked live in Vortex IQ Nerve Centre *Plugins Out-of-Date* is one of hundreds of KPI pulses Vortex IQ tracks across WooCommerce and 70+ other ecommerce connectors. Nerve Centre runs the detection layer; Vortex Mind investigates the cause when something moves; Ask Viq lets you interrogate any number in plain English. [Start for free](https://app.vortexiq.ai/login) or [book a demo](https://www.vortexiq.ai/contact-us) to see this metric running on your own data.