WPScan WordPress
Vulnerability Database
Be the first to know about vulnerabilities affecting your WordPress website
No credit card required
Cancel anytime
![quotes](/web/20211127143523im_/https://wpscan.com/_next/static/images/quote-9918f40b3f6b21ef627846d44f75d57b.png)
Useful and effective
A tiny plugin that timely reports vulnerable themes and plugins installed on your website. Effective and very easy to use – must have!
exmi
![WPSCAN database example](/web/20211127143523im_/https://wpscan.com/_next/static/images/heroImg-24ede3651f111f878cd5ac640d715a1d.png)
Trusted By
![Kinsta Logo](/web/20211127143523im_/https://wpscan.com/_next/static/images/kinsta-11f40b21d93949f161b8f5fddc125167.png)
![Telefonica Logo](/web/20211127143523im_/https://wpscan.com/_next/static/images/telefonica-056abee759644befa3c8f38e6602227f.png)
![JetPack Logo](/web/20211127143523im_/https://wpscan.com/_next/static/images/jetpack-e86d238b8ec59336d807f2969b6903db.png)
![GoDaddy Logo](/web/20211127143523im_/https://wpscan.com/_next/static/images/godaddy-b4d6dd51e50e9be01465ebcb4cf094f7.png)
![Roche Logo](/web/20211127143523im_/https://wpscan.com/_next/static/images/roche-82d54777a1356a104831981af7392b0f.png)
WHY WPSCAN
Cataloging 24,495 WordPress Core Vulnerabilities, Plugin Vulnerabilities and Theme Vulnerabilities
![10 Years image](/web/20211127143523im_/https://wpscan.com/_next/static/images/10-years-5e04272d3285ee8aaf6b4b7a3234b7dc.png)
Over 10 years
Collecting WordPress vulnerabilities for over 10 years
![Dedicated team image](/web/20211127143523im_/https://wpscan.com/_next/static/images/dedicated-team-6ad959455f08a28ced8f66963ac2d9ab.png)
Dedicated Team
Dedicated team of WordPress security experts
![Monitor web image](/web/20211127143523im_/https://wpscan.com/_next/static/images/monitor-1-2637e8db953d715459fbcc5be4e23214.png)
Monitor Web
Continually monitoring the web for new vulnerabilities
![Vulnerabilities counter image](/web/20211127143523im_/https://wpscan.com/_next/static/images/monitor-2-4a66149222224b925ca7ac005aca9744.png)
Over 22,000
Over 22,000 vulnerabilities in our database
The WPScan WordPress Vulnerability Database is a database of WordPress vulnerabilities, plugin vulnerabilities and theme vulnerabilities.
All of the vulnerabilities are manually entered into our database by dedicated WordPress security professionals.
We work with security researchers, the vendors and WordPress, to properly triage vulnerabilities.
Our vulnerabilities are being constantly updated with new information as it becomes available.
Our vulnerabilities are sourced from around the web, as well as being sent to us directly by security researchers. We also find many security issues ourselves.
No credit card required
Cancel anytime
![WPSCAN database example](/web/20211127143523im_/https://wpscan.com/_next/static/images/listImg-c4508f72d6a6ed253f93442d2c486df1.png)
SERVICES
WPScan Can Help You Detect Vulnerabilities Before It's Too Late
![WordPress Plugin](/web/20211127143523im_/https://wpscan.com/_next/static/images/wordpressPlugin-d5b2c86d62d6d474504124b708de8220.png)
WordPress Plugin
Vulnerability email alerts
Daily vulnerability scans
Report download
![Vulnerability API](/web/20211127143523im_/https://wpscan.com/_next/static/images/apiImage-9c520f1f35d5bd189bf4a8b7bdf7c70c.png)
Vulnerability API
Constantly updated
Developer friendly
Risk scores, PoCs and more
![Security Scanner](/web/20211127143523im_/https://wpscan.com/_next/static/images/securityScannerImage-f286872ffc1d7cb8ee00c7e3c13fb43a.png)
Security Scanner
Get a hacker's point of view
Command line interface
Great user documentation
HOW IT WORKS
Install The WPScan WordPress Security Plugin and Start Securing Your Website
![WPScan WordPress Security Plugin Video](/web/20211127143523im_/https://wpscan.com/_next/static/images/laptopImage-566185d36adf341319dbd11d82390ec3.png)
SECURITY RESEARCHERS
You can easily submit a vulnerability to our database. Get recognition and win rewards! 🎁
Get recognition
Speak to experts
![Add to database image](/web/20211127143523im_/https://wpscan.com/_next/static/images/securitySectionImg-8ec6854242e96782cc582133616be6f2.png)
![Wordpress logo](/web/20211127143523im_/https://wpscan.com/_next/static/images/WordPress_logo-5c8eb7fbe5a7db3bcfd41806e9316ef6.png)
Rated 4.1 / 5
Find out Why 500+ Businesses Trust WPScan to Help Keep Their Websites Secure
![Quote image](/web/20211127143523im_/https://wpscan.com/_next/static/images/quote@2x-af8155d582d52fbba8352f6000205eaa.png)
Light and Great
Panos
![Quote image](/web/20211127143523im_/https://wpscan.com/_next/static/images/quote@2x-af8155d582d52fbba8352f6000205eaa.png)
Very useful plugin and easy to use!
Chantelmerinowale
![Quote image](/web/20211127143523im_/https://wpscan.com/_next/static/images/quote@2x-af8155d582d52fbba8352f6000205eaa.png)
Very helpful, saves hours of work
Kenny Moore
Simple and Transparent Pricing
FREE
€0/month
25 API requests a day
WordPress Vulnerabilities
Plugin Vulnerabilities
Theme Vulnerabilities
Vulnerability Classification
Vulnerability Fixed in
Vulnerability References
How many API requests do I need?
Our WordPress scanner makes one API request for the WordPress version, one request per installed plugin and one request per installed theme.
On average, a WordPress website has 22 installed plugins.
STARTER
€5/month
75 API requests a day
WordPress Vulnerabilities
Plugin Vulnerabilities
Theme Vulnerabilities
Vulnerability Classification
Vulnerability Fixed in
Vulnerability References
How many API requests do I need?
Our WordPress scanner makes one API request for the WordPress version, one request per installed plugin and one request per installed theme.
On average, a WordPress website has 22 installed plugins.
PROFESSIONAL
€25/month
300 API requests a day
WordPress Vulnerabilities
Plugin Vulnerabilities
Theme Vulnerabilities
Vulnerability Classification
Vulnerability Fixed in
Vulnerability References
How many API requests do I need?
Our WordPress scanner makes one API request for the WordPress version, one request per installed plugin and one request per installed theme.
On average, a WordPress website has 22 installed plugins.
ENTERPRISE
Custom Pricing
Instant email alerts
Vulnerability details by ID
Latest API endpoints
Webhooks: Slack & HTTP
Description & PoC API data
CVSS Risk Scores
Billed annually.
Frequently Asked Questions
Where does the vulnerability data come from?
All of the vulnerabilities are manually entered into our database by a WordPress security professional. That means that each vulnerability is manually checked, which, although is very time consuming, drastically reduces the posibility of false positives.
Our vulnerabilities are sourced from around the web, as well as being sent to us directly by security researchers. We also find many security issues ourselves. We are a CVE Numbering Authority (CNA), so we are able to directly assign CVE numbers for WordPress core vulnerabilities, plugin vulnerabilities and theme vulnerabilities.
We are constantly updating older vulnerabilities with new information as it comes to light. Check out our WordPress Vulnerability Statistics for further details about our vulnerability data
How many API requests do I need?
Our WordPress scanner makes one API request for the WordPress version, one request per installed plugin and one request per installed theme. On average, a WordPress website has 22 installed plugins.
Does the API collect user data?
No. The only data the API stores is the scanner IP or domain, the WordPress version, plugin slugs and theme slugs. As well as, number of API requests, date and time stamps.
Which service should I use? The plugin, the scanner, or the API directly?
This will entirely depend on your needs and level of expertise.
Our WordPress security plugin is installed on your WordPress website and scans your websites daily with our API data to check if any of your plugins or themes are affected by any new security vulnerabilities.
Our WordPress security scanner is more targetted towards security professionals and developers. It uses a command line interface and therefore may be too technical for some users. The WPScan security scanner uses a black box approach to scanning and will give a hacker's point of view of your website's security.
You can also use our API directly within your own products and services. This is great if you don't want to use our WordPress security plugin or security scanner. You can build your own products and services using our data.