A Real CVE-Backed Benchmark for WordPress Plugin Vulnerability Detection

Labeled dataset, leakage-free evaluation protocol, benchmark code and an expert-verified evaluation subset for WordPress plugin vulnerability detection, built from real CVEs. The repository distributes labels, metadata and integrity hashes only; third-party plugin source code is not redistributed and is reconstructed locally by the included loader from the official WordPress.org repository, under each plugin's own license. Version 2 is an audited rebuild. A post-publication audit of v1 found duplicate code crossing fold boundaries despite plugin-level grouping, identical code carrying conflicting labels, and a stacking meta-learner trained on in-sample predictions. v2 collapses duplicates and near-duplicate clone families, verifies zero overlap by hash, clone family and plugin, replaces the stacking with a nested out-of-fold implementation, and publishes per-fold predictions and per-class scores so that every reported metric can be recomputed without retraining.