Vulnerability intelligence
A file-integrity scan only catches code that's already been tampered with. WPFixAgent separately checks every installed plugin and theme's current version against publicly disclosed vulnerabilities, so you can see and fix an outdated, at-risk component before it's actually used against you.
Every
Installed plugin
Every
Installed theme
Severity
Ranked
One-click
Update
How matching works
The connector reports every installed plugin and theme with its exact current version on each sync.
Installed versions are checked against known, publicly disclosed vulnerability records.
Matches are shown with severity so the most urgent issues are obvious first.
Update directly where a patched version exists, or review manually when it doesn't.
Software falls off the list automatically once it's updated past the affected version range.
Every plugin and theme currently installed on a connected website is checked against its exact installed version -- not just the ones that happen to be active.
Each match shows the CVE identifier, severity, affected version range, and what actually fixes it -- usually the patched version to update to.
Software with no known issues is marked Clean, not just left blank -- so you know the check actually ran, not that it was skipped.
A critical vulnerability match becomes a ranked issue like any other finding, and can trigger a notification depending on severity -- it isn't a separate report you have to remember to check.
Updating from a vulnerability finding uses the same protected update workflow as the Plugins & Themes tab -- a component snapshot first, automatic restore if the update fails.
Checks disclosed, publicly known vulnerabilities -- not a live exploit test
Severity comes from the disclosure, not an internal guess
A patched-version update doesn't require leaving the dashboard
Zero-day issues with no public disclosure yet won't appear here
Practical guidance
Critical errors
Recover from the WordPress critical error screen with a controlled process that protects evidence, creates a restore point, isolates the cause, and verifies the result.
Read guideAuto repair
Automation should resolve known, reversible WordPress conditions while risky database, malware, and hosting failures remain review-driven.
Read guideBackups
Local restore points make repairs fast, while off-site copies protect against hosting and disk failure. A serious recovery plan needs clear roles for both.
Read guideFAQ
Yes -- every installed plugin and theme is checked, whether or not it's currently active, since a dormant vulnerable component is still real risk.
The finding still shows with remediation guidance where available -- in that case, review or temporarily deactivate the affected component instead of updating.
No. The malware scanner looks for code that's already been tampered with; this checks whether legitimate, untouched code has a known disclosed vulnerability.
Critical vulnerability findings are one of the small set of events eligible to email -- see the Notifications page for the full policy.
Free 14-day trial · no card required
Install the connector, pair with a one-time token, and start monitoring in minutes -- upgrade whenever you're ready.