WPScan
What it is
WPScan combines a WordPress security scanner with a vulnerability database covering WordPress core, plugins, and themes. Its free black-box command-line scanner checks WordPress versions, installed plugins and themes, username enumeration, publicly accessible configuration files, and other listed targets. Authenticated scanning is supported, and the scanner is distributed as a Ruby gem, Docker image, and Homebrew package for macOS. The WPScan API supplies vulnerability data used by the scanner and a WordPress security plugin. WPScan says security professionals manually review vulnerabilities to reduce false positives. Enterprise API results include vulnerability descriptions, proof-of-concept fields, and CVSS risk scores, with instant email alerts plus Slack and HTTP webhooks listed for enterprise users. The Researcher plan costs nothing, allows non-commercial use and 25 API calls per day, and includes the CLI scanner. Enterprise pricing is custom by number of sites.
For and against
For
- Free CLI scanner included
- Manual vulnerability review stated
- Authenticated scanning supported
- Enterprise CVSS and proof-of-concept data
- Multiple installation methods
Against
- Researcher plan is non-commercial
- Researcher plan allows 25 API calls daily
- API has no uptime or accuracy guarantee
- Enterprise pricing is custom
The verdict
WPScan offers command-line and API-based WordPress vulnerability checking with a free Researcher option and expanded enterprise data. Users should account for API storage restrictions, service limitations, and plan boundaries.
Who it suits
WPScan suits WordPress administrators, security practitioners, and organizations scanning core, plugins, themes, and related exposures. Enterprise users may need its expanded API data and alert integrations.
Plans and prices
Researcher
Non-commercial use · 25 API calls per day · Free CLI scanner
Read 4 Oct 2026 · wpscan.com
Enterprise
Custom pricing by number of sites · Instant email alerts · Slack and HTTP webhooks · Description and PoC API data
Read 4 Oct 2026 · wpscan.com
On the record
- API
- The WPScan API provides vulnerability data for WordPress core, plugins, and themes and is used by its scanner and WordPress security plugin.wpscan.com · read 4 Oct 2026
- CLI scanning
- The free black-box CLI scanner checks WordPress version, installed plugins and themes, and other exposures including username enumeration and publicly accessible configuration files.wpscan.com · read 4 Oct 2026
- Data use limits
- The API terms prohibit permanent storage and caching of vulnerability data, and companies integrating WPScan data into their own services must use an Enterprise account.wpscan.com · read 4 Oct 2026
- Enterprise API data
- Enterprise API results include vulnerability descriptions, proof-of-concept fields, and CVSS risk scores.wpscan.com · read 4 Oct 2026
- Integrations
- WPScan lists Slack and HTTP webhooks for enterprise users and names Kali Linux, Dradis, BackBox Linux, Pentoo, Samurai WTF, and BlackArch as integrations.wpscan.com · read 4 Oct 2026
- Maker
- WPScan's enterprise terms identify Automattic Inc. as the provider of the enterprise solution.wpscan.com · read 4 Oct 2026
- Privacy
- WPScan says its API stores the scanner IP or domain, WordPress version, plugin and theme slugs, request count, and timestamps.wpscan.com · read 4 Oct 2026
- Purpose
- WPScan provides a WordPress security scanner and vulnerability database covering WordPress core, plugins, and themes.wpscan.com · read 4 Oct 2026
- Scanning scope
- WPScan says it identifies sites with software containing known vulnerabilities but does not determine whether a site has been compromised or remove malware.wpscan.com · read 4 Oct 2026
- Service limits
- WPScan states that its API carries no uptime or accuracy guarantee and that it may not record every known vulnerability.wpscan.com · read 4 Oct 2026
- Supported installation methods
- The CLI scanner is distributed as a Ruby gem, Docker image, and Homebrew package for macOS.wpscan.com · read 4 Oct 2026
- Vulnerability review
- WPScan says vulnerabilities are manually checked by WordPress security professionals to reduce false positives.wpscan.com · read 4 Oct 2026
