Issue WordPress Toolkit vulnerability report unclear

[Visnet]

Dear Plesk team and Pleskians,

For one staging website on my Plesk server (Plesk Obsidian) I am getting the following two reports from the WordPress Toolkit extension:

website URL filtered	WordPress License Manager for WooCommerce plugin <= 2.2.5 - Sensitive Information Disclosure vulnerability
website URL filtered	WordPress License Manager for WooCommerce plugin <= 2.2.5 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

However, it is unclear:

• What the nature of this vulnerability is, how to find more information about it and how to pinpoint the issue in the plugin code
• How to solve this or what to report to the plugin developer (for instance, this plugin does not have any new versions available yet)

Without this information reports like these are more confusing than helpful.

Am I missing something?
Or could this be improved to be more helpful to a server administrator?

Cheers!

 

[Visnet]

To add to my initial report:

Using Plesk 18.0.41.1 with WordPress Toolkit extension 5.9.3-6032

I just found out that when using the WordPress Toolkit through the Plesk panel, under Security > Vulnerabilities (filter) the same notices actually provide a 'Details' button that is linking to:
- WordPress License Manager for WooCommerce plugin <= 2.2.5 - Sensitive Information Disclosure vulnerability - Patchstack
- WordPress License Manager for WooCommerce plugin <= 2.2.5 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability - Patchstack

Suggestion:
Either include these same links in the report e-mail or explain how/where to find them in the Plesk panel.

 

[avatolin]

Thank you for your feedback! We have filed a task to improve our email notifications based on your feedback. Let us know if you have any other feedback.