The open-source
WordPress security scanner

Open-source. 294 checks. Runs locally. The CVE feed is aggregated nightly from up to 8 public sources (NVD, MITRE, GHSA, OSV, Wordfence, WPVulnerability, Patchstack, CIRCL); per-source counts are published in the feed header. Threat-intel enrichment through 10 integrations (feeds, exports and push targets: CISA KEV, EPSS, Exploit-DB, Metasploit, MITRE ATT&CK, STIX, MISP, OpenCTI, OTX, GreyNoise). Release assets are Sigstore-signed and carry GitHub build-provenance attestations.

Beyond scanning, the CLI has 66 subcommands including wpsecscan emit (14 export formats — SBOM, CEF, LEEF, HIPAA, FedRAMP, …), wpsecscan push (16 integrations — GitLab CI, CircleCI, Sentry, DataDog, DefectDojo, …), and wpsecscan ai (7 LLM-backed helpers — remediation, WAF rule gen, drift, …).

$ wpsecscan https://example.com --format json
waf                       ok   (Cloudflare detected)
core_version              warn (6.4.2 → 6.5.5 available)
plugins                   ok   (24 enumerated)
tls_headers               fail (HSTS missing)
csp                       warn (unsafe-inline in style-src)
interactivity_api_directive_xss ok   (no reflection)
plugin_slug_squat_check   ok   (52 plugins, no author drift)
…
multisite_network_option_idor ok

┌─ Summary ────────────────────────────────────────┐
│ Critical: 0   High: 2   Medium: 5   Low: 12
│ Risk score: 42/100   Grade: B
│ Scanned in 1m 47s · Report: report.json
└──────────────────────────────────────────────────┘

$