WPScan

What WPScan is

WPScan is a WordPress security scanner and vulnerability database for WordPress core, plugins, and themes. Its free black-box command-line scanner checks a site's WordPress version, installed plugins and themes, and exposures such as username enumeration and public configuration files. The CLI is available as a Ruby gem, Docker image, and Homebrew package for macOS. WPScan's API supplies vulnerability data used by its scanner and a WordPress security plugin. WPScan says security professionals manually review vulnerabilities to reduce false positives. Enterprise API results include descriptions, proof-of-concept fields, and CVSS risk scores; the Enterprise plan also lists instant email alerts and Slack and HTTP webhooks. The free Researcher plan is limited to non-commercial use and 25 API calls per day. API terms prohibit permanent storage and caching of vulnerability data, and companies incorporating WPScan data into their own services need an Enterprise account. WPScan says the API has no uptime or accuracy guarantee and may not record every known vulnerability. The scanner identifies sites using software with known vulnerabilities; it does not determine whether a site has been compromised or remove malware.