scan vulnerable plugins