Vulnerable Plugin/Theme Version Flagged by a Security Scan

Symptom

A vulnerability scanner or security feed reports a known CVE in an installed plugin/theme version, with no visible symptom on the site yet.