WordPress dependency security audit

Inventory and rate third-party code that ships with a plugin/theme. Do not stop at Composer: WordPress products often copy minified JS or prefix PHP namespaces and remove the manifests that package-manager audit tools need.

Audit workflow

1. Inventory every production dependency and record the evidence for its name, version, source, load path, and runtime context.
2. Run available lockfile/package-manager audits without rewriting lockfiles.
3. For each component, verify affected/fixed ranges against current primary upstream advisories and release notes.
4. Trace the advisory's vulnerable API from plugin input to the exact call.
5. Rate the plugin-specific reachability and impact separately from the upstream advisory's base severity.
6. Recommend a compatible fixed version, containment, tests, and an SBOM/update process. State unknowns instead of converting them into “no vulnerability.”