The listing can lie by omission
Active installs and a five-star mean say nothing about CVE-year-old RCE still shipping as “latest.” Famous cases (file manager plugins, abandoned SEO packs) kept looking fine on the directory page.
You need the slug, the version string, and a vulnerability feed that actually covers WordPress plugins — general package databases often return empty for this ecosystem.
What AuditHQ checks on a plugin project
Known advisories for this slug + version from a public WordPress vulnerability feed.
Staleness: months since last_updated, Tested up to far behind current core, abandoned-looking listings.
Static PHP in the wordpress.org zip (never executed): wp_ajax_nopriv_, CSRF/authz heuristics, SQLi/XSS shapes, unserialize on request input, upload/path sinks, sslverify => false.
Before you click Install
1. Note the version on the listing.
2. Run an AuditHQ WordPress plugin audit for that slug.
3. If known CVEs fire, do not install — wait for a fixed release or pick another plugin.
4. If the zip shows nopriv handlers or sslverify disabled, treat that as a review gate even when no CVE is filed yet.
Authors: clear the same bar
Ship a release that bumps Tested up to and closes advisory-matched versions. Remove sslverify => false. Guard ajax with capability and nonce checks.
Re-run the package scan after each release so the directory story matches the zip.