Vulnerability monitoring for your WordPress plugins & themes.
Relvato checks the plugins and themes you actually have installed against known vulnerabilities, and flags any that have been closed or abandoned on wp.org — the ones that quietly become a security hole.
- ✓Installed plugins and themes matched against known CVEs
- ✓WordPress itself: an insecure version flagged — critical when exploited — with why it didn't update itself
- ✓Powered by the Wordfence Intelligence vulnerability database
- ✓Plugins or themes closed or removed from wp.org
- ✓Abandoned plugins or themes with no updates in a long time
- ✓Curated vendor/remote-access advisories — an update that grants the vendor admin access to your site
- ✓Severity plus a fix or replace recommendation
Most WordPress hacks come through a plugin or theme with a public CVE that never got updated, or one the author abandoned. Your dashboard won't tell you. Relvato compares your installed plugin and theme slugs and versions against the Wordfence Intelligence vulnerability data and warns you which to update or replace.
On WordPress, a vulnerable plugin from wordpress.org can be updated to the version that fixes it with one click in WordPress → Relvato. Relvato then re-runs every monitor that passed before, and if one now fails, it alerts you and offers Undo in WordPress: one click puts the previous version back and holds the new one so it isn't reinstalled. A paid plugin, or one with no fix yet, can be deactivated the same way — verified, and switched back on with one click if the site needs it.
Vulnerability scan vs exposure scan vs pentest — which do you actually need? Our guide breaks down what each finds and when to run it.
- Reads your installed plugin and theme slugs and versions via the plugin (shared only when you enable this monitor).
- Matches them against the Wordfence Intelligence vulnerability feed (and WPScan), plus wp.org's closed or abandoned status.
- Reports each risky plugin or theme with its CVE and severity, linked to its Wordfence record, so you know what to update or replace first.
Data sourceWordfence Intelligence Vulnerability Database, CISA Known Exploited Vulnerabilities (KEV) catalog
Does it cover themes as well as plugins?
Yes. Relvato reads both your installed plugins and your themes and checks each against the vulnerability database and wp.org's closed/abandoned status.
Where does the vulnerability data come from?
From the Wordfence Intelligence Vulnerability Database — an industry-leading, continuously updated feed of WordPress plugin and theme CVEs — optionally combined with WPScan. Each finding links back to its Wordfence record.
What data does it share?
Only your installed plugin and theme names and versions, and only when you enable this monitor — never file contents.
Does it need the plugin?
Yes — reading the installed plugin and theme inventory needs the WordPress plugin.
What's a “vendor / remote-access advisory”?
A deliberate plugin behaviour that no vulnerability feed reports — for example, an update that grants the plugin's vendor administrative or remote-management access to your site. Relvato surfaces these as a factual, sourced heads-up so you can decide whether you trust that access; it's a prompt to review, not an accusation.
Can Relvato help me update a vulnerable plugin?
Yes, for plugins from wordpress.org when a fixed version is known. You start the update with one click in WordPress → Relvato: the plugin installs exactly the version that fixes every issue found, Relvato re-runs every monitor that passed before, and if one of them now fails, it alerts you and offers Undo in WordPress. WooCommerce is the exception: its updates upgrade the database and can't be undone safely, so update it from WordPress after a backup.
What stops WordPress from reinstalling a version you rolled back?
A hold. The Relvato plugin tells WordPress's auto-updater to skip that exact version, and refuses it from any installer that goes through WordPress — a person clicking Update, WP-CLI, ManageWP or a host's update tool. A newer release installs normally, and you can release the hold on WordPress's Plugins screen (“Release the hold”).
Put this monitor on autopilot.
Free forever on one site — 100 runs a month, started by you or weekly, no card. Pro re-runs your monitors by itself after every update.