WPScan is unclaimed —

WPScan

It's like having your own team of WordPress security experts·wpscan.com

Free plan · Not open source See pricing ↓

WPScan is an enterprise vulnerability database for WordPress that tracks known vulnerabilities affecting WordPress core, plugins, and themes. It offers a web-based site scanner, a command-line security scanner, and an API for programmatic access to vulnerability data. The database is manually vetted and continuously updated by WordPress security professionals, and WPScan acts as a CVE Numbering Authority for WordPress-related vulnerabilities.

What it's for

Scan a WordPress site for known vulnerabilitiesMonitor WordPress core, plugins, and themes for new vulnerabilitiesAccess vulnerability data via API for integration into other productsUsername enumeration on WordPress sitesDetect weak passwords via password brute forcingDetect exposed wp-config.php backupsDetect publicly accessible database dumpsDetect exposed error logs from pluginsMedia file enumerationDetect vulnerable Timthumb filesCheck if WordPress readme file is exposedCheck if WP-Cron is enabledCheck if user registration is enabledDetect Full Path Disclosure issuesDetect upload directory listing

Features 21

Command-line interface (CLI) security scanner
CVE Numbering Authority (CNA) for WordPress vulnerabilities
CVSS Risk Scores
Database dump delivered daily at 6am GMT
Description & Proof-of-Concept (PoC) data via API
Exposed error log detection
Exposed wp-config.php backup detection
Full Path Disclosure detection
Instant email alerts
Manually vetted vulnerability entries
Media file enumeration
Publicly accessible database dump detection
Upload directory listing detection
Username enumeration
Vulnerability data API
Vulnerable Timthumb file detection
Weak password brute forcing detection
Webhooks (Slack & HTTP)
Website vulnerability scanner (web-based)
WordPress core, plugin, and theme vulnerability database
WP-Cron and user registration status checks

At a glance

free tierAPI

TypeWeb app

DeploymentCloud

PlatformsWeb

Forlarge enterprises, security researchers, developers, WordPress security professionals

CompanyWPScan

Integrations

Jetpack ProtectSlack

Pricing

Enterprise plans are quote-based and priced by number of sites protected. Non-commercial API use is free up to 25 calls per day; commercial API use requires a paid license obtained via quote. The WPScan CLI Scanner itself is free to use for everyone without requiring the API.

EnterpriseQuote

Quote-based; requires contacting sales for a custom price.

Custom pricing based on number of sites protected

ResearcherFree

Free for security researchers using the CLI scanner and API for non-commercial purposes.

Capped at 25 API calls per day; for non-commercial use only