WordPress plugin and theme checks

When an exposure scan finds that a site runs WordPress, it adds a WordPress pass: it lists the core version, plugins and themes the site gives away, looks up known vulnerabilities for the ones with an exact version, and makes a few read-only checks of common WordPress exposures.

When it runs

Profiles: Standard, Deep and Extreme, which are the profiles that inspect the website. Quick and Port-scan do not run it.
Verification: those profiles are deep scans, so the WordPress pass runs only on a domain you have verified.
Plans: any plan can run it by hand within the manual scan allowance. Scheduled exposure scans, which run Standard, are on paid plans only.
WordPress only: a site counts as WordPress when its homepage loads /wp-content/ or /wp-includes/ assets, carries the WordPress generator tag, or links the WordPress REST API. Any other site skips the pass and gets no extra requests.

What it reads

The inventory comes from the homepage HTML only:

Core: the WordPress version from the core asset stamps or the generator tag.
Plugins and themes: every slug under /wp-content/plugins/ and /wp-content/themes/, with its version when the asset URL carries one (?ver=). A slug seen without a version is recorded as "version not exposed". At most 100 versioned components are read.

Everything found is added to the domain's software inventory, so it also counts for KEV and CVE alerts.

Vulnerability matching

Core, plugins and themes with an exact version are looked up in two public sources. Neither needs an account or a key, so there is nothing to set up.

WPVulnerability (its API is at wpvulnerability.net), a free WordPress vulnerability database that combines advisories from Wordfence, Patchstack, WPScan, the CVE list, the EU vulnerability database and Japan's JVN. It is asked about one plugin, theme or core version at a time.
WordPress.org's release list, which marks every core release as latest, outdated or insecure. It catches a core security release the day it ships, before the advisories are written up.

Each advisory whose affected range includes the installed version becomes a finding with the advisory title, the CVE when there is one, the affected versions, the CVSS score, a link to the advisory and the version to update to. Ranges are matched exactly: "before 5.3.2" includes 5.3.1 and not 5.3.2, and "3.6.0 to 3.6.2" includes both ends. Severity follows the CVSS score (9 and up critical, 7 high, 4 medium, below that low). An advisory with no published score is medium, and one on CISA's known-exploited list is at least high. When no fix exists yet, the finding says so and suggests removing or replacing the plugin.

A core version WordPress.org lists as insecure gets its own medium finding, "WordPress x.y.z has a newer security release", naming the release that fixes that branch.

Each answer is kept for a day, so a plugin is looked up at most once a day however many sites use it.

What is not checked

Some components cannot be checked. They are never called safe. One information finding, "Some WordPress components could not be checked for known vulnerabilities", lists them and says why:

No visible version: the plugin or theme loads assets without a ?ver= stamp.
Not in the database: usually a premium or custom plugin or theme that is not on WordPress.org.
No answer: the database could not be reached and there is no earlier answer to use. The component is checked again on the next scan.

If a lookup fails after a component has been checked before, the scan uses the last answer it got. A finding does not appear or disappear because a source was down. If that answer is more than a week old, the information finding says so.

Posture checks

A handful of plain GET requests, only on WordPress sites:

Check	Finding
`/xmlrpc.php` answers	Low: XML-RPC is reachable (a common brute-force and pingback target). If it answers with an access denial, an information finding says it is blocked
`/readme.html` is public	Low: it gives away the exact core version
The REST API is linked from the homepage	Information: confirm `/wp-json/wp/v2/users` does not list usernames to anonymous visitors

The pass never guesses usernames or passwords, never tries default logins, and never probes thousands of plugin paths.

Where

Findings appear with the rest of the scan's findings, named "WordPress checks" in the app and "WordPress Intelligence" on the web, and can be dismissed like any other (Findings and dismissals). Plugins and themes show under Software (web) or Monitoring, Software (iOS).

Common questions

My plugin is vulnerable but no finding appeared. The site may not expose that plugin's version in its asset URLs, the plugin may not be in the public database, or the database may not have answered for that scan. The "could not be checked" information finding says which. Check the version on the server, or add the plugin to the watchlist.

Do I need a Wordfence or WPScan key? No. Both sources are public and free. Wordfence advisories are included through WPVulnerability.net, and the finding links to the original advisory.

Can I hide versions from the scan? Yes, removing ?ver= stamps hides them from the scan and from anyone else, but it also means the scan cannot match them. Keeping plugins updated is the fix that matters.