plugin-audit

name	plugin-audit
description	List installed plugins, classify (essential / safe / risky / abandoned), surface ones with known CVEs. Use monthly per site, or after every WP migration.

Plugin audit

Most WP sites have plugins that haven't been touched in years. Audit finds the risk.

Steps

1. List plugins (WP-CLI plugin list --status=active or Rocket.net MCP)
2. Per plugin: name, version installed, latest available, last update date, author
3. Classify:
   • Essential: actively used + actively maintained
   • Safe: not actively used but maintained and clean
   • Risky: known CVE OR > 1 year since last update
   • Abandoned: > 2 years since last update OR removed from repo
4. Cross-check against the WPVulnDB / Patchstack feed
5. Surface findings to wiki/properties/websites/<domain>/plugin-audit-<date>.md

Report shape

---
kind: plugin-audit
domain: <domain>
audited_on: <date>
total: <n>
essential: <n>
safe: <n>
risky: <n>
abandoned: <n>
---

## Risky plugins
[Per-plugin: name, version, vulnerability, suggested action]

## Abandoned plugins
[Per-plugin: name, last update, suggested replacement]

## Actions
1. Update [list] (low risk)
2. Replace [list] (need alternative)
3. Remove if unused [list]