=== BeleShield Vulnerability Scanner ===
Contributors: beletech76, freemius
Tags: security, vulnerability, plugins, scanner
Requires at least: 6.0
Tested up to: 7.1
Stable tag: 0.4.2
Requires PHP: 7.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Alerts you when an active plugin or theme has a known, unpatched vulnerability (CVE/WPVDB).

== Description ==

BeleShield Vulnerability Scanner scans the active plugins and themes on your WordPress
site and alerts you as soon as one of them has a known, published vulnerability (CVE),
using an external vulnerability database.

Free version: manual scan of plugins, with full detail for every vulnerability found
(CVE, severity, source link).

Pro version: automatic daily scan, scan of themes in addition to plugins, and automatic
email alerts.

== Installation ==

1. Upload the `beleshield-vulnerability-scanner` folder to `/wp-content/plugins/`.
2. Activate the plugin from the "Plugins" menu in WordPress.
3. Go to Settings > BeleShield Vulnerability Scanner to run your first scan.

== Frequently Asked Questions ==

= Does the plugin modify my site? =

No, BeleShield Vulnerability Scanner is read-only: it checks the versions of your active
plugins/themes against a database of known vulnerabilities, without ever modifying any
file.

= What data is sent outside my site? =

On each scan, BeleShield Vulnerability Scanner sends only the slug and version number of
each active plugin/theme to the external service WPVulnerability (wpvulnerability.net),
in order to check for known vulnerabilities. No other data (site content, personal
information, user data) is transmitted. Responses are cached locally for 12 hours to
limit the number of requests.

This service is provided by WPVulnerability: [Privacy Policy](https://www.wpvulnerability.com/privacy/),
[Data License](https://www.wpvulnerability.com/license/).

The Pro version also communicates with Freemius servers (freemius.com) for license and
subscription management, per their [Privacy Policy](https://freemius.com/privacy/) and
[Terms of Service](https://freemius.com/terms/).

== External services ==

This plugin connects to the following third-party services:

**WPVulnerability** (wpvulnerability.net)
Used to look up known vulnerabilities for each active plugin and theme. On every scan
(manual, or automatic daily scan in the Pro version), the slug and version number of
each active plugin/theme is sent to this service; no other data is transmitted.
[Privacy Policy](https://www.wpvulnerability.com/privacy/) -
[Data License](https://www.wpvulnerability.com/license/)

**Freemius** (freemius.com) - Pro version only
Used to manage the license and subscription for the Pro plan. Account and billing data
entered at checkout is sent to and processed by Freemius as merchant of record.
[Privacy Policy](https://freemius.com/privacy/) -
[Terms of Service](https://freemius.com/terms/)

== Changelog ==

= 0.4.2 =
* The Pro plan is now purchasable: `has_paid_plans` is set to `true` now that the
  Pro plan is unhidden and live on Freemius. No functional change to the code.

= 0.4.1 =
* Removed the hard-coded cron no-op: the daily automatic scan is now gated the same way
  as the rest of the Pro-only features, directly behind an `is_paying_or_trial__premium_only()`
  call, so there is no dead/disabled code shipped in the free package.

= 0.4.0 =
* Renamed the plugin to "BeleShield Vulnerability Scanner" (previously "Vuln Watch") to
  avoid confusion with existing trademarked vulnerability-scanning services.
* The free version now shows the full detail of every vulnerability found (CVE, severity,
  source link) instead of a count only. The Pro plan now only adds features that are
  physically absent from the free package: automatic daily scan, theme scanning, and
  automatic email alerts.
* Translated the readme and plugin description to English.
* Added Terms of Service / Privacy Policy links for the external services used.

= 0.3.2 =
* Updated "Tested up to" (7.1) for WordPress.org compliance.

= 0.3.1 =
* WordPress.org compliance: the email alert function (Pro plan) remained present in the
  code, even though inaccessible without a license, because only its call site was
  removed from the free package. It is now itself marked __premium_only() and therefore
  physically absent from the free package, like theme scanning.

= 0.3.0 =
* WordPress.org compliance: Pro plan features (theme scanning, automatic email alerts)
  are now removed from the free version's code at build time, instead of merely being
  hidden behind a license check.
* Disclosed the data sent to the external vulnerability service in this file.

= 0.2.0 =
* Theme scanning in addition to plugins (Pro plan).
* Explicit handling of vulnerability API failures (no more silent false "no
  vulnerability detected").
* Freemius integration for license and subscription management.

= 0.1.0 =
* First version: scan of active plugins against the WPVulnerability database.
