Freedom251 › Vulnerability Scanning Software
WPScan
What WPScan is
WPScan combines a WordPress security scanner with a vulnerability database for WordPress core, plugins, and themes. Its free black-box command-line scanner checks a site’s WordPress version, installed extensions, and exposures such as username enumeration and publicly accessible configuration files. It also supports authenticated scanning and targets including usernames, media, configuration backups, database exports, TimThumb files, and remote WordPress applications. The CLI is available as a Ruby gem, Docker image, or Homebrew package for macOS.
The WPScan API supplies vulnerability data used by the scanner and a WordPress security plugin. WPScan says WordPress security professionals manually review vulnerabilities to reduce false positives. Enterprise API results add descriptions, proof-of-concept fields, and CVSS risk scores; enterprise users can also receive instant email alerts and use Slack or HTTP webhooks. Named integrations include Kali Linux, Dradis, BackBox Linux, Pentoo, Samurai WTF, and BlackArch.
The free Researcher plan costs nothing, is for non-commercial use, allows 25 API calls per day, and includes the CLI scanner. Enterprise pricing is custom by number of sites. API terms restrict permanent storage and caching, and companies embedding WPScan data in their own services need an Enterprise account.
Who it suits
WPScan suits WordPress site owners and security professionals who need to check WordPress software against known vulnerabilities, including through authenticated scans. The free Researcher plan is for non-commercial use; organizations integrating vulnerability data into their own services need an Enterprise account.
What it does well
- Scans WordPress core, plugins, themes, and additional listed targets.
- Free CLI checks versions, installed extensions, and exposure points.
- Supports authenticated scanning.
- Manual vulnerability reviews aim to reduce false positives.
- Enterprise API includes descriptions, proof-of-concept fields, and CVSS scores.
- CLI is distributed as a Ruby gem, Docker image, and macOS Homebrew package.
What to know first
- Researcher use is non-commercial only.
- Researcher API access is limited to 25 calls per day.
- API terms prohibit permanent storage and caching of vulnerability data.
- The API has no uptime or accuracy guarantee and may omit known vulnerabilities.
Limits
The free Researcher plan is limited to non-commercial use and 25 API calls per day. Enterprise API results include vulnerability descriptions, proof-of-concept fields, and CVSS risk scores; API terms prohibit permanent storage and caching of vulnerability data.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Researcher | Non-commercial use · 25 API calls per day · Free CLI scanner | Free |
| Enterprise | Custom pricing by number of sites · Instant email alerts · Slack and HTTP webhooks · Description and PoC API data · CVSS risk scores | On request |
As wpscan.com lists them, read 4 Oct 2026. The maker's own page has the final word.
Getting started
- Visit https://wpscan.com/.
- Choose the free Researcher plan for non-commercial use, or contact WPScan about Enterprise pricing.
- Install the CLI through its Ruby gem, Docker image, or Homebrew package for macOS.
- Run the CLI against a WordPress site; authenticated scanning is supported.
Verdict
Choose WPScan to check WordPress installations and related targets for known vulnerabilities, with a free CLI for non-commercial use. Organizations that need API data in their own services must use Enterprise, and the scanner does not determine whether a site was compromised or remove malware.
Questions
How much does WPScan cost?
The Researcher plan is free. Enterprise pricing is custom based on the number of sites.
What does the free plan include?
Researcher includes the free CLI scanner and 25 API calls per day for non-commercial use.
Which platforms does WPScan support?
Its listed platforms are API, Linux, macOS, and self-hosted. The CLI is distributed as a Ruby gem, Docker image, and Homebrew package for macOS.
What does WPScan scan?
Targets include WordPress core, plugins, themes, usernames, media, configuration backups, database exports, TimThumb files, and remote WordPress applications. Authenticated scanning is supported.
Can a company store or reuse WPScan API data?
The API terms prohibit permanent storage and caching of vulnerability data. Companies incorporating WPScan data into their own services must use an Enterprise account.
Does WPScan detect compromises or remove malware?
No. WPScan identifies sites with software containing known vulnerabilities; it does not determine whether a site has been compromised or remove malware.
Facts from WPScan's own pages
- API
- The WPScan API provides vulnerability data for WordPress core, plugins, and themes and is used by its scanner and WordPress security plugin. · wpscan.com, 4 Oct 2026
- CLI scanning
- The free black-box CLI scanner checks WordPress version, installed plugins and themes, and other exposures including username enumeration and publicly accessible configuration files. · wpscan.com, 4 Oct 2026
- Data use limits
- The API terms prohibit permanent storage and caching of vulnerability data, and companies integrating WPScan data into their own services must use an Enterprise account. · wpscan.com, 4 Oct 2026
- Enterprise API data
- Enterprise API results include vulnerability descriptions, proof-of-concept fields, and CVSS risk scores. · wpscan.com, 4 Oct 2026
- Integrations
- WPScan lists Slack and HTTP webhooks for enterprise users and names Kali Linux, Dradis, BackBox Linux, Pentoo, Samurai WTF, and BlackArch as integrations. · wpscan.com, 4 Oct 2026
- Maker
- WPScan's enterprise terms identify Automattic Inc. as the provider of the enterprise solution. · wpscan.com, 4 Oct 2026
- Privacy
- WPScan says its API stores the scanner IP or domain, WordPress version, plugin and theme slugs, request count, and timestamps. · wpscan.com, 4 Oct 2026
- Purpose
- WPScan provides a WordPress security scanner and vulnerability database covering WordPress core, plugins, and themes. · wpscan.com, 4 Oct 2026
- Scanning scope
- WPScan says it identifies sites with software containing known vulnerabilities but does not determine whether a site has been compromised or remove malware. · wpscan.com, 4 Oct 2026
- Service limits
- WPScan states that its API carries no uptime or accuracy guarantee and that it may not record every known vulnerability. · wpscan.com, 4 Oct 2026
- Supported installation methods
- The CLI scanner is distributed as a Ruby gem, Docker image, and Homebrew package for macOS. · wpscan.com, 4 Oct 2026
- Vulnerability review
- WPScan says vulnerabilities are manually checked by WordPress security professionals to reduce false positives. · wpscan.com, 4 Oct 2026
Where WPScan stands on Freedom251
- Vulnerability Scanning Software#12 of 35