Know which updates fix security holes: ToggleWP Cloud now reads your plugins’ release notes
Most plugin updates can wait for your next maintenance window. Some can’t. When a plugin author fixes a security hole, the release notes often say so (“Fixed a stored XSS in the shortcode”, “Added a missing capability check”), but the update looks the same as any other in the WordPress dashboard. And it can take days, sometimes weeks, before that fix becomes a published CVE that vulnerability feeds pick up.
That gap is when sites get hit. The fix has shipped, the change is public, and anyone can compare the old version with the new one to see what was wrong.
ToggleWP Cloud now closes that gap. It reads the release notes of every update waiting on your client sites and tells you when one fixes a security issue, so you can install it sooner rather than later.
How it works
1. It finds the updates waiting on each site
Your client sites already report their plugins to ToggleWP Cloud for vulnerability checks. With the latest ToggleWP release, they also report which plugins have an update waiting and which version it is.
2. It reads the release notes
- Free plugins from wordpress.org: ToggleWP Cloud fetches each plugin’s changelog and upgrade notices from wordpress.org, about twice a day.
- Premium plugins: most premium plugins update through the vendor’s own updater, and that updater usually provides the changelog too. Your sites send it along with the pending version.
- Updates checked by Update Guard: when Update Guard downloads a premium update to scan it, ToggleWP Cloud also reads the changelog inside the package.
It only reads the entries between the version a site has installed and the version waiting for it, so a site that’s three releases behind gets checked for all three.
Some authors don’t put the notes in the update at all, just “See the full changelog at …”. ToggleWP Cloud follows that link and reads the page instead. For GitHub release pages, it reads the releases straight from GitHub.
3. It decides which releases fix a security issue
First, a quick word check skips the ordinary entries, the ones about new features, speed improvements and compatibility.
Entries that mention anything security-related (XSS, CSRF, SQL injection, a CVE, authorisation, escaping, “security fix” and so on) go to Claude, which reads the entry and decides:
- Is this really a security fix? “Added two-factor login for your users” is a security feature, not a fix, so it isn’t flagged.
- How urgent is it? High for flaws anonymous visitors or subscribers could exploit, such as SQL injection or file uploads. Medium for most XSS and CSRF fixes, or a security fix with no details. Low for general hardening.
- What was fixed? One plain sentence you can pass on to a client.
Each release is checked once and the result is shared across every site that needs it. These checks run on ToggleWP Cloud’s own AI key and don’t use your AI allowance.
4. It tells you
When a site has an update waiting that fixes a security issue:
- The site gets a Security update badge on the Vulnerabilities page. Click it to see the plugin, the installed and new versions, how urgent it is and the one-line summary. Plugins from wordpress.org also get a link to their changelog.
- Your agency gets a “Security updates available” email listing every affected site, with new ones marked. You get one email per release, not a daily reminder.
If a release’s notes only link to a page that ToggleWP Cloud couldn’t read, the site gets a grey Not checked badge instead, so you know to look at that update yourself. These appear only on the dashboard, not in the email.
Once the site installs the update, the alert clears the next time it reports in.
How it fits with vulnerability alerts
Vulnerability alerts from the Wordfence Intelligence feed still work exactly as before. Security update alerts cover the time before a fix appears there:
| Vulnerability alerts | Security update alerts | |
|---|---|---|
| Based on | Published vulnerability records (CVEs) | The plugin’s own release notes |
| Tells you | This version is known to be vulnerable | An update waiting for this site fixes a security issue |
| When | Once the vulnerability is published | Within hours of the release |
If a plugin already has a Wordfence match, you’ll only see that alert, not both. Security update alerts also don’t change a site’s vulnerability count or highest severity, so those numbers still mean “published, known issues”.
Your settings
Security update emails go to the same addresses as your vulnerability digest, or to your agency’s owners if you haven’t set any. They’re on by default. To turn them off, untick Email about security updates under Vulnerabilities → Settings. The dashboard badges stay either way.
What you need
- ToggleWP Cloud with Vulnerabilities in your plan.
- The latest ToggleWP plugin on your client sites for premium plugins. Sites on older versions are still covered for free plugins from wordpress.org.
A note on what it can’t see
The checks are only as good as the release notes. Some authors write “Bug fixes and improvements” over a security fix, and some premium updaters don’t provide a changelog at all.
When the notes only link to another page, ToggleWP Cloud tries to read that page. If the page can’t be read, it doesn’t treat the update as safe to leave. That happens when the page needs a login, is built in the browser with JavaScript, is down for several tries in a row, or doesn’t mention the new version yet. The site shows a Not checked badge on the Vulnerabilities page, with a link to the page so you can read it yourself.
A missing alert doesn’t mean an update is unimportant, so keep your normal update routine. This feature makes sure the urgent updates don’t wait for it.
Get started
Update the ToggleWP plugin on your client sites, check who gets your alert emails under Vulnerabilities → Settings, and you’re done. The next time one of your plugins ships a security fix, you’ll hear about it before it becomes a headline.