Security finding
A script library, the CMS or a plugin runs a version with a known flaw or without support
Security Warning Severity: High
Part of the audit Outdated and vulnerable libraries. Finding id: security.vulnerableSoftware.
What it costs you
The flaws of this version are public, with the version number that has them. A stranger who reads the version from your pages knows which ones to try. A version without support gets no more fixes.
What to do
Update [name] to [fixed in] or later, or remove it if nothing uses it.
What it checks
- Library has a known security flaw
- Library version no longer supported
- Website system or plugin is out of date
How to fix it
Fix
Update or remove it
- Find where [name] [version] comes in: a package file, a copy in the theme, or a tag pasted into a template ([example]).
- Update to [fixed in] or later and read the release notes for breaking changes.
- If the library is no longer used, delete the tag and the file.
How to check: Recrawl: [name] reports a version without advisories.
A real case
Equifax did not patch a critical flaw in software it ran after being alerted in March 2017, and the breach that followed exposed data of about 147 million people. In 2019 it agreed to pay at least 575 million dollars in a settlement with the FTC, the CFPB and US states.