WPScan

5.6easy start · #32 of 36
in Vulnerability Scanning Software

Free to practise onnot on record
Free trialnot on record
Well documentednot on record
Runs where you worknot on record

Runs on api, Linux, Mac, self-hosted.

WPScan is ranked #32 of 36 in vulnerability scanning software on The Geeks Club. It runs on API, Linux, macOS, Self-hosted. There is a free plan.

WPScan plans and pricing

All plans

Researcher Free Non-commercial use · 25 API calls per day · Free CLI scanner wpscan.com · 4 Oct 2026

Enterprise Not published Custom pricing by number of sites · Instant email alerts · Slack and HTTP webhooks · Description and PoC API data · CVSS risk scores wpscan.com · 4 Oct 2026

Compared on vulnerability scanning software

Supported targets: WordPress core, plugins, themes, usernames, media, configuration backups, database exports, TimThumb files, and remote WordPress applications
Authenticated scanning: Yes

Best WPScan alternatives

See all 12

Intruder 0 of 4 in the starter kit Lesson 17.9 ManageEngine Vulnerability Manager Plus 0 of 4 in the starter kit Lesson 27.9 OpenVAS 0 of 4 in the starter kit Lesson 37.9 Nmap 0 of 4 in the starter kit Lesson 47.8 Qualys External Attack Surface Management 0 of 4 in the starter kit Lesson 57.8 Pentest-Tools Port Scanner 0 of 4 in the starter kit Lesson 67.7

The record

Purpose: WPScan provides a WordPress security scanner and vulnerability database covering WordPress core, plugins, and themes.
Vulnerability review: WPScan says vulnerabilities are manually checked by WordPress security professionals to reduce false positives.
CLI scanning: The free black-box CLI scanner checks WordPress version, installed plugins and themes, and other exposures including username enumeration and publicly accessible configuration files.
API: The WPScan API provides vulnerability data for WordPress core, plugins, and themes and is used by its scanner and WordPress security plugin.
Integrations: WPScan lists Slack and HTTP webhooks for enterprise users and names Kali Linux, Dradis, BackBox Linux, Pentoo, Samurai WTF, and BlackArch as integrations.
Enterprise API data: Enterprise API results include vulnerability descriptions, proof-of-concept fields, and CVSS risk scores.
Data use limits: The API terms prohibit permanent storage and caching of vulnerability data, and companies integrating WPScan data into their own services must use an Enterprise account.
Privacy: WPScan says its API stores the scanner IP or domain, WordPress version, plugin and theme slugs, request count, and timestamps.
Service limits: WPScan states that its API carries no uptime or accuracy guarantee and that it may not record every known vulnerability.
Scanning scope: WPScan says it identifies sites with software containing known vulnerabilities but does not determine whether a site has been compromised or remove malware.
Supported installation methods: The CLI scanner is distributed as a Ruby gem, Docker image, and Homebrew package for macOS.
Maker: WPScan's enterprise terms identify Automattic Inc. as the provider of the enterprise solution.
Price from: Free

Where it ranks on The Geeks Club

Best Vulnerability Scanning Software in 2026#32 of 36

Is WPScan yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote WPScan

Sources

wpscan.com· checked 4 Oct 2026
wpscan.com/pricing/· checked 4 Oct 2026
wpscan.com/how-to-install-wpscan/· checked 4 Oct 2026
wpscan.com/api/· checked 4 Oct 2026
wpscan.com/enterprise-customers-features/· checked 4 Oct 2026
wpscan.com/terms/· checked 4 Oct 2026