Title: VIP Dashboard Plugins panel Author: WordPress VIP Documentation Published: November 15, 2022 Last modified: March 11, 2025 --- 1. [Codebase Manager](https://docs.wpvip.com/codebase-manager/) 2. VIP Dashboard Plugins panel # VIP Dashboard Plugins panel The Plugins** **panel in the [VIP Dashboard](https://docs.wpvip.com/vip-dashboard/) displays a list of plugins that are located in the [`/plugins` directory](https://docs.wpvip.com/wordpress-skeleton/plugins-directory/) of a WordPress environment’s [wpcomvip GitHub repository](https://docs.wpvip.com/wpcomvip-github-repository/) branch. For each plugin scanned by [Codebase Manager](https://docs.wpvip.com/codebase-manager/), the Plugins panel will indicate if version updates are available, or if the scan has identified a known security vulnerability for a plugin. A pull request to update a plugin can be initiated from within the VIP Dashboard Plugins panel. **Note** Customers can also stay informed of known security vulnerabilities that are identified by the scans with automated messages: * **[Notifications](https://docs.wpvip.com/notifications/):** Automated messages that are triggered by **all levels** of identified security vulnerabilities for plugins that are already deployed to application environments. Notifications are opt-in, and can be sent to a webhook URL for Slack, Google Chat, or Microsoft Teams, [a general-purpose webhook URL](https://docs.wpvip.com/notifications/webhook-urls/), or an email address. * **[Important Alerts](https://docs.wpvip.com/notifications/important-alerts/):** Automated Notifications that are triggered by identified security vulnerabilities rated as **high** or **critical** for plugins that are already deployed to application environments. All users with an Org admin role or an App admin role receive Important Alerts by email by default. ## Limitations * Only plugins that are located within an application’s `/plugins` directory are scanned. * WP-CLI and cron must be in a healthy, functioning state on a WordPress environment in order for plugins associated with that environment to appear as expected on the Plugins panel. * Typically, only plugins that can be downloaded from the [WordPress.org Plugin Directory](https://wordpress.org/plugins/) can be scanned. In some cases it is possible for a plugin downloaded from a source other than the WordPress.org Plugin Directory to be scanned if the plugin has a valid license activated. * Only plugins with a valid WordPress plugin slug are eligible for an option to create a pull request. For a plugin downloaded from a source other than the WordPress. org Plugin Directory, the slug might only be detectable if the plugin is activated, and might also require a valid license to be activated. * For plugins managed by composer, pull requests that are created from within the Plugins panel will only be successful if the plugin is resourced from [the `wpackagist` composer repository](https://wpackagist.org/). * After merging a pull request that updates the version of a plugin, the plugin’s version and related security warnings might not update on the **Plugins** panel for up to 15 minutes. ## Access **Prerequisites** * To **view** an environment’s Plugins panel, a user must have at minimum an [Org member role](https://docs.wpvip.com/manage-user-access/vip-dashboard/org-roles) or an [App write role](https://docs.wpvip.com/app-role/) for that application. * To **view **and** select **pull request options in the Actions column, a user must have at minimum an [Org member role](https://docs.wpvip.com/manage-user-access/vip-dashboard/org-roles) or an [App write role](https://docs.wpvip.com/app-role/) for that application. To access the **Plugins** panel: 1. Navigate to the [VIP Dashboard](https://dashboard.wpvip.com/) for an application. 2. The **Plugins** panel is environment-specific (e.g., Production, Develop). Select an environment from the dropdown located at the upper left of the VIP Dashboard application view. 3. Select “**Code**” from the sidebar navigation at the left of the screen. 4. Select **“Plugins”** from the submenu. 5. By default, the “**Plugin Management**” tab is displayed. ## Plugin Management By default, all plugins located within the [`/plugins` directory](https://docs.wpvip.com/wordpress-skeleton/plugins-directory/) of an environment’s wpcomvip repository branch that have been scanned by Codebase Manager are displayed in the Plugin Management tab of the Plugins panel. ![](https://docs.wpvip.com/wp-content/uploads/sites/2/2025/01/plugin-management- tab-2.png?w=1024) Example screenshot of the Plugin Management tab in the VIP Dashboard Plugins panel. Plugins are listed in alphabetical order by name. Depending on availability, information about each plugin will also include: * **NAME:** The name of the plugin, and a relative path to the plugin’s directory in the environment’s GitHub repository branch. * **VERSION:** The version of the plugin located in the environment’s GitHub repository branch. If a more recent version of the plugin is identified and available, that version will also be displayed with the label “Available”. * **KNOWN VULNERABILITIES:** When applicable, linked notices stating the severity level of a known vulnerability will display for the version of the scanned plugin. The notice will link to [the WPScan site](https://wpscan.com/) where more details specific to the reported vulnerability can be reviewed. * **ACTION:** If a more recent version of a scanned plugin is available and able to be automatically provided by Codebase Manager, a selectable button will be displayed that allows a user to: - **Create pull request**: Create a pull request in the branch of the wpcomvip repository where the plugin is located. The pull request will update the plugin to the most recent available version. - **View pull request**: View an already created pull request that is not yet merged. Only users with existing [access to the application’s GitHub repository](https://docs.wpvip.com/github-user-access/) will have permission to view the pull request. ### Filter options The list of plugins shown can be filtered by: * **Update Available**: Only display plugins for which an updated version is available. * **Security Issues**: Only display plugins for which a vulnerability has been identified. ### Create a pull request **Prerequisites** * To **view **and** select **pull request options in the Actions column, a user must have at minimum an [Org member role](https://docs.wpvip.com/manage-user-access/vip-dashboard/org-roles) or an [App write role](https://docs.wpvip.com/app-role/) for that application. * To merge a pull request, a user must have [a GitHub user account with with `write` access permissions or greater](https://docs.wpvip.com/manage-user-access/github/) for an application’s GitHub repository. * The option to select a button labeled “**Create Pull Request**” is only available for environments that have [Default Deployment](https://docs.wpvip.com/code-deployment/default-deployment/) enabled. If a Codebase Manager scan has identified a known security vulnerability or an available version update for a plugin, a button labeled “**Create Pull Request**” will be available in the “**Action**” column. Selecting the button will trigger a pull request containing the most recent version of the plugin to be created. The pull request will be made against the GitHub branch that deploys to the environment currently being viewed in the VIP Dashboard. For security reasons, plugin updates should be made as soon as possible. It is recommended to test the updated version of the plugin on a non-production environment before updating the plugin on production. If a newer version of a plugin becomes available before a created pull request has been merged, a “**Create Pull Request**” button will reappear for the plugin in the Plugins panel. Select the button to create a new pull request with the most recent version of the plugin. #### Information included in pull requests Pull requests that are initiated from the VIP Dashboard Plugins panel will include the following information in the pull request description field: * **Details:** Source URL of the reported vulnerable plugin in the [WordPress.org Plugin Directory](https://wordpress.org/plugins/). * **Installed location:** Path to the directory in the GitHub repository branch matching the reported vulnerable plugin. * **Version:** The new version of the plugin that is being updated. #### Code review for pull requests By default, [the VIP Code Analysis Bot](https://docs.wpvip.com/vip-code-analysis-bot/default-behavior/) will not analyze pull requests that are initiated from the VIP Dashboard Plugins panel. This configuration is designed to enable plugin updates to be made as quickly and simply as possible. Customer’s can optionally run the same PHPCS scan as the Bot locally against the updated version of the plugin. [Maintaining plugins at their most up to date versions](https://docs.wpvip.com/plugins/version-updates-and-maintenance/) is a best practice for WordPress applications. An important part of this best practice is to also locally review the code of the updated version with PHPCS, act on any feedback as needed, and [complete testing for the updated plugin on a non-production environment](https://docs.wpvip.com/plugins/third-party-plugins/#h-testing-on-the-vip-platform) before updating the plugin on production. Following this process enables developers to more confidently merge the pull requests generated by Codebase Manager. ## Plugin Vulnerability Statistics The **Vulnerability Statistics** tab of the Plugins panel contains interactive charts that provide historical insights into plugin vulnerabilities. The displayed data is environment-specific (e.g., production, develop). To view the plugin vulnerability statistics for a different environment, select that environment from the dropdown at the upper left of the VIP Dashboard application view. ### Open Plugin Vulnerabilities This chart shows a historical record of the number of open vulnerabilities by severity. As plugin vulnerabilities are resolved through [updating plugins](https://docs.wpvip.com/plugins/version-updates-and-maintenance/), they are no longer considered open. If this chart shows an upward trend, that is a sign that engineering teams might need to work through a backlog of open plugin vulnerability alerts. ![](https://docs.wpvip.com/wp-content/uploads/sites/2/2025/03/image_bb3cac.png?w =1024) Example screenshot of the Open Plugin Vulnerabilities chart on the Vulnerability Statistics tab of the VIP Dashboard Plugins panel. ### Plugin Vulnerabilities Detected This chart shows the number of vulnerabilities detected by severity over time creating a graphical log of the frequency of plugin vulnerabilities on an application. This can be used to get a rough picture of  the general health of the plugins in an application. ![](https://docs.wpvip.com/wp-content/uploads/sites/2/2025/03/image_dbf0eb.png?w =1024) Example screenshot of the Plugin Vulnerabilities Detected chart on the Vulnerability Statistics tab of the VIP Dashboard Plugins panel. ### Display data as a chart or a table All data in the **Vulnerability Statistics** tab can be displayed in either a chart format (default) or a table format. The display options for “Chart” or “Table” can be selected using the “Chart / Table” toggle under the Insights & Metrics tab. ### Display data for a specific time period A user can select a preset list of time periods or enter custom time periods for environment data in a datepicker. To access the datepicker, select the field in the upper right of the panel that displays timestamps for the date range of the currently displayed data. For example, a user can select from a displayed list of preset windows of time for the “Last 3 days”, or up to the “Last 180 days”. More specific periods of time can be selected by entering dates in the fields labeled“** Start**” and “**End**” in the section of the datepicker labeled “**Custom Date Range**“. The range of data displayed can be further specified by entering times (in UTC) for dates entered. Select the button labeled “**Apply**” to save the settings and refresh the displayed data. Last updated: March 11, 2025