WPScan
WordPress vulnerability database, API, and security scanner
About WPScan
WPScan maintains a WordPress vulnerability database covering core, plugins, and themes, with more than 88,000 entries, and sells access to it through an API, webhooks, and database exports. It also offers a command-line scanner that security professionals use to audit WordPress sites. WPScan is part of Automattic, is a CVE Numbering Authority, and supplies the vulnerability data behind Jetpack Protect.
Pros & Cons
Pros
- One of the largest WordPress-specific vulnerability databases, with more than 88,000 entries
- Many entries are manually verified, which cuts false positives
- CVE Numbering Authority status means faster, authoritative CVE assignment for WordPress issues
- Free researcher tier and CLI scanner for non-commercial use
- API, webhooks, and JSON exports fit into existing security tooling
Cons
- No self-serve paid plans; commercial use requires an Enterprise quote
- Free tier is capped at 25 API calls per day and limited to non-commercial use
- The scanner is command-line only, which is less approachable for non-technical site owners
- Terms forbid caching or permanently storing API data outside Enterprise exports
- Small businesses are steered to Jetpack Protect rather than a WPScan plan
Key Features
WordPress vulnerability database
Catalogs more than 88,000 vulnerabilities in WordPress core, plugins, and themes, with hundreds of new entries added each month.
Manually verified entries
Security professionals vet many vulnerabilities by hand and mark them with a Verified flag in the API to reduce false positives.
Vulnerability database API
REST API (v3) that returns vulnerabilities by WordPress version, plugin, theme, or vulnerability ID, authenticated with a per-account token.
CLI security scanner
Command-line scanner that enumerates a WordPress site's version, plugins, themes, and users and checks them against the database.
Database exports
Enterprise customers can download full JSON exports of plugin, theme, and core vulnerability data.
Webhooks and alerts
Enterprise plans include instant email alerts and Slack or HTTP webhooks when new vulnerabilities affect monitored software.
CVSS scores and PoC data
Enterprise API responses include descriptions, proof-of-concept details, and CVSS risk scores.
CVE Numbering Authority
As a CNA, WPScan can assign CVE IDs directly to WordPress core, plugin, and theme vulnerabilities.
Free site check
A web form on wpscan.com runs an instant vulnerability report for a site you have permission to scan.
Pricing
- Non-commercial use only
- CLI scanner
- API access capped at 25 calls per day
- Custom pricing by number of sites
- Instant email alerts
- Vulnerability details by ID
- Latest API endpoints
- Slack and HTTP webhooks
- Description and PoC API data
- CVSS risk scores
- Database exports
Best For
Security product integrations
Hosting providers and security vendors license the API or database exports to flag vulnerable plugins and themes for their customers.
Penetration testing
Pentesters run the CLI scanner to enumerate a WordPress site's components and known vulnerabilities during an engagement.
Agency site monitoring
Agencies managing many WordPress sites use Enterprise webhooks to get alerts when a plugin they run gets a new vulnerability.
Security research
Researchers use the free tier to look up vulnerabilities and submit new findings for triage and CVE assignment.
Similar Tools
Replicate
Run AI with an API
Cerebras
The world's fastest AI inference � 20x faster than GPU clouds
DALL-E 3
OpenAI's AI image generator built into ChatGPT for effortless creation
Flux
Open-source AI image generator with photorealistic output and clean text rendering
Groq
Ultra-fast AI inference powered by custom LPU silicon
DeepSeek
Open-source AI models with reasoning-first architecture at a fraction of the cost