OOPSpam Team

OOPVulns is a modern, accessible WordPress plugin that continuously monitors your site for known security vulnerabilities in WordPress core, plugins, and themes.
<h4>Features</h4>
<ul>
<li>Comprehensive Scanning Scans WordPress core, all plugins, and all themes for known vulnerabilities</li>
<li>Explicit Opt-In Vulnerability scanning is disabled by default and only runs after admin consent</li>
<li>Automatic Scans Configurable daily or weekly automatic scanning</li>
<li>Email Notifications Get notified when vulnerabilities are detected</li>
<li>Modern Dashboard Clean, accessible admin interface with detailed vulnerability information</li>
<li>Severity Indicators Color-coded severity levels (Critical, High, Medium, Low)</li>
<li>Update Guidance See which vulnerabilities have fixes available</li>
</ul>
<h4>How It Works</h4>
The plugin checks your installed WordPress core version, plugin versions, and theme versions against the OOPSpam vulnerability database. When a known vulnerability is found, you’ll see it in the dashboard and optionally receive an email notification.
<h4>External Service</h4>
This plugin connects to the OOPSpam API to retrieve vulnerability information. When a scan runs, the following data is sent:
<ul>
<li>WordPress core version</li>
<li>Plugin slugs and versions</li>
<li>Theme slugs and versions</li>
</ul>
No personal data, user information, or site content is transmitted. 
Vulnerability API checks are disabled by default and only run after an administrator explicitly enables scanning in plugin settings.
<ul>
<li><a href="https://www.oopspam.com/terms" rel="nofollow ugc">OOPSpam Terms of Service</a></li>
<li><a href="https://www.oopspam.com/privacypolicy" rel="nofollow ugc">OOPSpam Privacy Policy</a></li>
</ul>

OOPVulns: Vulnerability Scanner

Monitor your WordPress site for security vulnerabilities in core, plugins, and themes.

Peter Butler

The recent Timthumb.php vulnerability (discussed <a href="http://markmaunder.com/2011/08/02/technical-details-and-scripts-of-the-wordpress-timthumb-php-hack/" rel="nofollow ugc">here</a>) has left scores of unsuspecting bloggers hacked. It’s the perfect combination of not so easy to fix for the technically disinclined, and easy to find and exploit for the malicious – resulting in a disastrous number of compromised sites.
The Timthumb Vulnerability Scanner plugin will scan your entire wp-content directory for instances of any outdated and insecure version of the timthumb script, and give you the option to automatically upgrade them with a single click. Doing so will protect you from hackers looking to exploit this particular vulnerability.
After new, lesser vulnerabilities were found, it became apparent that the plugin needs to be dynamic – able to keep you up to date with the latest version of timthumb, without requiring a plugin upgrade. The plugin now checks for the latest available version of timthumb routinely (each time you visit the scanner page, but no more than once a day), and can download and install the latest version, rather than the one included with the plugin. Scans are run daily (unless you disable them via the options link on the scanner page) via wp-cron to keep up with any new plugins or themes you’ve installed.
More info at <a href="http://codegarage.com/blog/2011/09/wordpress-timthumb-vulnerability-scanner-plugin/" rel="nofollow ugc">CodeGarage</a>.
Special thanks to <a href="http://jacobwg.com/" rel="nofollow ugc">Jacob Gillespie</a> for help with the bulk upgrade feature.

Timthumb Vulnerability Scanner

Scans your wp-content directory for vulnerable instances of timthumb.php, and optionally upgrades them to a safe version.

OOPVulns: Vulnerability Scanner vs Timthumb Vulnerability Scanner