In reply to Carl Hancock.

I like the idea behind this plugin, but unfortunately the way they implemented it kind of defeats the purpose. They bundle their vulnerability database with the plugin, rather than periodically querying a remote API for real-time data and then caching the result.

That means that in order for the plugin to know about newly discovered vulnerabilities, you have to first install an updates for it. If you're the type of person that immediately installs all available plugin updates, then this doesn't really offer much benefit to you, since you'd have already installed the fixed version of the vulnerable plugin.

If you're not that type of person, then this plugin won't know about new vulnerabilities and can't inform you about them.

The one exception to that is if a vulnerability is known, but not patched yet. It would be useful in that situation, but only if you updated the plugin so it could learn about the new vulnerability.