# WPSecScan - Full LLM context

Last generated for WPSecScan v2.9.1 (release dated 2026-10-12) by scripts/gen-llms.py from
src/data/release.json and src/data/checks.json.

---

## What WPSecScan is

WPSecScan is a defensive WordPress security scanner.

- Free. AGPL-3.0-or-later. No paid tier.
- Local. Runs on your machine; there is no hosted scanning service.
- 294 checks across 11 categories, 66 CLI subcommands.
- 31 of the checks are aggressive (active probing); the rest are passive.
- Defensive use only. Use it on sites you own or have written permission to test.

## Author and provenance

- Maintainer: Bryan (GitHub: bryanflowers, contact: bryaninbangkok@gmail.com)
- Repo: https://github.com/bryanflowers/wpsecscan
- Current release: v2.9.1, 2026-10-12 (https://github.com/bryanflowers/wpsecscan/releases/tag/v2.9.1)
- License: AGPL-3.0-or-later
- CI runs the test suite on Python 3.10-3.13, Ubuntu and Windows.

## Install

```
pip install wpsecscan                 # PyPI, Python 3.10+
pip install -e ".[all]"               # from a source checkout
docker build -t wpsecscan .           # build locally from the repo Dockerfile
```

Windows: download `wpsecscan.exe` (CLI) or `wpsecscan-gui.exe` from the GitHub release
(about 22 MB each). The binaries are not Authenticode-signed, so a SmartScreen warning
is expected; verify them as described under Supply chain below.

- Release page: https://github.com/bryanflowers/wpsecscan/releases/tag/v2.9.1
- PyPI: https://pypi.org/project/wpsecscan/

No other distribution channel exists: no OS package-manager packages and no published
container image.

## Usage

The target is a positional argument:

```
wpsecscan https://example.com
wpsecscan https://example.com --format json
wpsecscan https://example.com --aggressive --owned
wpsecscan --help
```

Consent gate: Aggressive checks run only against targets you have marked as owned (`--owned`, `WPSECSCAN_OWNED_TARGETS`, or `wpsecscan owned add <host>`); otherwise the scan runs passive and records why.

Other entry points:

- `wpsecscan --daemon CONFIG.yml`: run continuously from a config file
- `wpsecscan schedule {install [--time HH:MM] | uninstall | pause | resume | status}`
- `wpsecscan digest {configure | test | send}`
- `wpsecscan sites add URL [--weekly]`
- `wpsecscan owned add <host>`: mark a host as owned

There are 66 CLI subcommands in total; `wpsecscan <subcommand> --help` lists the options.

## Output

- `--format` values (9): json, html, csv, md, xlsx, sarif, burp, docx, exec-pdf
- `wpsecscan emit <format>`: 14 export formats
- `wpsecscan push <provider>`: 16 push integrations
- `wpsecscan ai <helper>`: 7 optional LLM helpers (you supply the key; off unless invoked)
- Run `wpsecscan emit --help`, `wpsecscan push --help` and `wpsecscan ai --help` for the exact lists.

## Read-only proof helpers

`--prove` runs 5 proof helpers that collect minimal read-only evidence through a
detected weakness (see docs/proof.md in the repository).

## Monitoring

A continuous file-change monitor (via the companion plugin) and a new-CVE alert watcher
for the components a scan detected. Further watcher modules ship in the codebase but are
not yet wired to a scheduler. Scheduled scans use `schedule` and `--daemon`.

## CVE database

The vulnerability feed is aggregated nightly from up to 8 public sources
(NVD, MITRE, GHSA, OSV, Wordfence, WPVulnerability, Patchstack, CIRCL); per-source counts are published in the feed header.
Not every source returns entries on every run. Entries are merged and deduplicated and
published to the `data-feed` branch of the GitHub repository.

- Feed: https://raw.githubusercontent.com/bryanflowers/wpsecscan/data-feed/vuln-db.json

## Threat intelligence

Ten threat-intelligence integrations (feeds, exports and push targets) are available.

## External requests

A default (passive) scan can contact third parties beyond the target: crt.sh and other
certificate-transparency services, an RDAP service, api.wordpress.org, api.osv.dev, and, when the JSON report is
produced, CISA KEV and EPSS (api.first.org). The CVE feed is fetched from GitHub. These
receive the target hostname, detected component names or CVE ids, not site secrets.

## Standards mapping

OWASP and MITRE ATT&CK tags are on nearly every check; CWE and D3FEND tags are on about 189 of 294.
Most checks carry PCI-DSS, NIST 800-53 and ISO 27001 mappings (these three are also the per-check compliance tags).

The compliance report covers 12 frameworks (PCI-DSS, NIST 800-53 and ISO 27001 are mapped per check; the rest are report-level):

PCI-DSS 4.0 - NIST 800-53 - ISO 27001 - ISO 27001:2022 - NIST CSF 2.0 - CIS v8 - HITRUST - CMMC 2.0 - HIPAA - SOC 2 - FedRAMP - GDPR.

## Supply chain

Release assets are published on GitHub (https://github.com/bryanflowers/wpsecscan/releases/tag/v2.9.1):

- Sigstore signatures: `.sig` and `.pem` files next to the exe, gui exe, wheel and sdist (not SHA256SUMS.txt or the SBOM), verifiable with cosign
- GitHub build-provenance attestations: `gh attestation verify wpsecscan.exe --owner bryanflowers`
- SBOM in CycloneDX format: https://github.com/bryanflowers/wpsecscan/releases/download/v2.9.1/sbom.cyclonedx.json
- Checksums: https://github.com/bryanflowers/wpsecscan/releases/download/v2.9.1/SHA256SUMS.txt

Full instructions: https://wpsecscan.com/verify/

## Companion plugin

The WordPress companion plugin is source-only, in the `wp-plugin/` folder of the repository.

## Comparison with other tools

See https://wpsecscan.com/compare/ for a comparison with Wordfence, WPScan CLI and Sucuri.
WPSecScan is an auditing tool: it is not a firewall and does not remove malware.
It can be used alongside those tools.

## Privacy

What the website collects (analytics, the feedback form, the CDN) is described at
https://wpsecscan.com/privacy/.

## Security reports

Responsible disclosure: https://github.com/bryanflowers/wpsecscan/blob/main/SECURITY.md, https://wpsecscan.com/.well-known/security.txt,
or bryaninbangkok@gmail.com.

## The 294 checks, by category

Generated from src/data/checks.json. Format: `id` - title (aggressive checks are marked).

### Discovery & enumeration (28)

- `waf` - WAF / CDN detection
- `core_version` - WordPress core version
- `plugins` - Plugin enumeration
- `themes` - Theme enumeration
- `users` - User enumeration
- `subdomains` - Subdomain discovery
- `rest_api` - WP REST API surface audit
- `favicon_fingerprint` - Favicon fingerprint
- `admin_ajax_brute_surface` - admin-ajax throttle probe
- `wp_rest_methods` - REST method enumeration
- `waf_ruleset` - WAF rule-set identification
- `referenced_buckets` - Referenced-bucket open-listing probe (S3/GCS/R2/Spaces)
- `ajax_surface` - admin-ajax action surface (aggressive)
- `plugin_hash_fingerprint` - Plugin file-hash fingerprint (#2)
- `users_deep` - Deep user enumeration — 10 sources (#5)
- `spider_crawl` - Spider — recursive link crawler (#18)
- `forced_browse` - Forced-browse hidden-path discovery (#21)
- `openapi_scanner` - OpenAPI / Swagger endpoint scanner (#26)
- `mobile_app_endpoints` - Mobile-app association discovery (#38)
- `host_recon` - Host port recon — Docker/Redis/k8s/etc. (#40)
- `origin_ip_discovery` - Origin-IP discovery via subdomains (#23)
- `server_stack_reveal` - Server-stack reveal + PHP EOL detect (#B22+B29)
- `waf_brand_deep` - WAF brand deep-detect — 11 vendors (#B23)
- `js_framework_deep` - JS framework deep-detect + version pin (#B31)
- `rest_app_passwords_enum` - REST Application Passwords auth probe (#62)
- `lead_gen_list_id_enum` - Klaviyo / Mailchimp list-ID enumeration (A12)
- `bucket_shadow_takeover` - S3 / R2 / GCS shadow-bucket takeover (A15)
- `perf_of_target` - Operational perf audit: TTFB / Lighthouse / DB-queries / cache-hit / cold-start (P146-P150)

### Authentication & session (32)

- `login` - Login surface
- `login_throttle` - Login rate-limiting test
- `csrf_nonce` - CSRF / nonce form audit
- `app_passwords` - Application Passwords audit
- `nonce_freshness` - WP nonce freshness audit
- `oauth_redirect` - OAuth / login redirect-URI
- `login_timing` - Login timing side-channel (user enum)
- `oauth_oidc` - OAuth2 / OIDC discovery audit
- `saml_xsw` - SAML / XSW endpoint discovery
- `companion_advanced` - Companion v1.1 endpoints: failed-login geo, Tor admin, backups, perms, 2FA
- `jwt_audit` - JWT audit (alg=none + weak HS256)
- `hibp` - HaveIBeenPwned lookup
- `users_me_capability_leak` - REST /users/me unauthenticated capabilities
- `woocommerce_order_idor` - Unauthenticated WC order IDOR probe
- `db_admin_login_probe` - Adminer/phpMyAdmin login-form depth probe
- `login_redirect_http_hop` - HTTP hop in /wp-login.php redirect chain
- `oauth_redirect_misconfig` - OAuth redirect_uri staging/localhost misconfig
- `default_creds` - Default credentials probe (aggressive)
- `session_fixation` - Session-fixation precondition probe
- `csrf_entropy` - CSRF nonce entropy sampler
- `auth_modernisation` - Auth modernisation — passkey/2FA/SAML/OAuth/JWT/magic-link (#40-46)
- `mfa_priv_account_audit` - MFA on privileged accounts (companion) (#63)
- `app_passwords_stale_audit` - Application Passwords stale-token audit (A8, auth)
- `multisite_sso_key_reuse` - WP Multisite SSO key reuse audit (A13)
- `jwt_auth_plugin_audit` - JWT-Auth plugin secret-key audit (A17)
- `gdpr_dsr_endpoint_enum` - GDPR DSR ajax-action auth check (A21)
- `plugin_install_rest_race` - REST plugin-install endpoint auth audit (A22)
- `stripe_connect_state_csrf` - Stripe-Connect OAuth state-CSRF audit (F5)
- `multisite_super_admin_rbac` - Multisite super-admin RBAC bypass probe (F13)
- `webauthn_rp_id_audit` - WebAuthn / Passkeys RP-ID audit (F22)
- `plugin_slug_squat_check` - Plugin slug-squatting (wp.org author drift) (F70)
- `login_throttle_deep` - Deep throttle mapping (opt-in, 20 min)

### Transport & headers (33)

- `tls_headers` - TLS & security headers
- `csp` - CSP deep analysis
- `cookies` - Cookie hardening
- `http_methods` - HTTP method enumeration
- `cors` - CORS misconfiguration
- `mixed_content` - Mixed-content (HTTP-in-HTTPS) audit
- `tls_deep` - Deep TLS audit
- `cache_headers` - Cache-header audit
- `server_timing` - Server-Timing / debug headers
- `cache_poisoning` - Web-cache poisoning probe
- `http2_settings` - HTTP/2 fingerprint + EOL backend
- `smuggling_probe` - HTTP request-smuggling indicators
- `cookie_consent` - GDPR/ePrivacy cookie-consent audit
- `tls_modern` - TLS modern features: 0-RTT replay-risk + OCSP stapling + must-staple
- `permissions_policy` - Permissions-Policy header audit
- `csp_report_endpoint` - CSP report-uri/report-to endpoint health
- `hsts_preload_eligibility` - HSTS preload eligibility audit
- `ct_log_recent_certs` - CT-log recent unexpected cert issuances
- `http3_fingerprint` - HTTP/3 + QUIC fingerprint
- `hpp` - HTTP Parameter Pollution probe (aggressive)
- `header_smuggling_case` - Header smuggling via case sensitivity (aggressive)
- `tls_reneg_dos` - TLS renegotiation DoS probe (#26)
- `crypto_agility` - Crypto agility — PQ/TLS 1.3 hybrid/cert inventory (#47-51)
- `sri_audit` - Subresource Integrity (SRI) audit (#B24)
- `sri_pwa_misc` - SameSite/WebDAV/PWA/HTTP3/contrast (#B25+B30+B32-B34)
- `cookie_consent_desync` - Tracking cookies fire pre-consent (A20)
- `hsts_preload_mismatch` - HSTS preload list vs header mismatch (A30)
- `ct_log_shadow_cert` - CT-log shadow certificate detection (A31)
- `html_api_csp_nonce` - WP 6.7 HTML API breaks CSP nonces (O142)
- `cache_poisoning_v2` - Cache poisoning chain v2 (#35) (aggressive)
- `headless_cors_lockdown` - Headless WP REST CORS lockdown (F12)
- `wc_payment_link_replay` - WC pay-for-order Referrer-Policy audit (F4)
- `cookie_banner_cosmetic_vs_blocking` - Cookie banner cosmetic-vs-blocking probe (F69)

### File & directory exposure (32)

- `exposed_files` - Exposed files
- `directory_listing` - Directory listing
- `debug_leaks` - Debug & info leaks
- `robots_sitemap` - robots.txt / sitemap audit
- `secret_leak` - Accidental API-key leak scan
- `backup_exposure` - Backup-plugin file exposure
- `security_txt` - security.txt (RFC 9116) audit
- `source_maps` - Source-map exposure
- `upload_path_predictable` - Predictable upload paths
- `well_known` - /.well-known/ resource enumeration
- `webdav` - WebDAV / OPTIONS enumeration
- `dev_params` - Beta/test/debug query parameters
- `uploads_year_listing` - /wp-content/uploads/YYYY/ directory listing
- `phpinfo_dangerous_directives` - phpinfo() dangerous-runtime-flag audit
- `wp_debug_display_via_rest` - WP_DEBUG_DISPLAY via malformed REST POST
- `backup_file_fuzz` - Backup-file long-tail fuzzer
- `timthumb` - timthumb.php CVE detection (#1)
- `premium_license_leak` - Premium plugin license-key leak scan (#7)
- `composer_lock_audit` - composer.lock exposure + CVE check (#59)
- `package_lock_audit` - package-lock.json exposure + CVE check (#60)
- `yarn_pnpm_lock_audit` - yarn.lock / pnpm-lock.yaml exposure (#61)
- `git_dir_deep_scan` - Deep .git directory enumeration (#66)
- `env_file_enum` - .env file exposure + secret sniffing (#67)
- `helm_compose_leak` - Helm/compose/k8s manifest exposure (#68)
- `tailwind_css_comment_leak` - Tailwind/CSS filesystem-path leak (#69)
- `solidity_abi_leak` - Solidity contract ABI leak (#74)
- `wallet_seed_phrase_leak` - Wallet seed phrase leak (BIP-39 scan) (#75)
- `payment_gateway_test_keys` - Payment-gateway test/sandbox key leak (#76)
- `composer_npm_typosquat` - Composer/npm typosquat dep advisory (A34)
- `github_actions_workflow_leak` - CI workflow YAML exposed on webroot (A35)
- `trellis_yaml_audit` - Roots Trellis YAML exposure (N137)
- `nextjs_env_var_exposure` - Next.js NEXT_PUBLIC_* secret-leak probe (F16)

### Injection & client-side (24)

- `xss_dom_sinks` - DOM-XSS source/sink scan
- `crlf_location_injection` - CRLF injection in Location header (redirect endpoints)
- `sqli` - SQL injection probes (aggressive)
- `xss_reflected` - Reflected XSS probes (aggressive)
- `path_traversal` - Path traversal probes (aggressive)
- `sendmail_injection` - Email header injection probe (aggressive)
- `prototype_pollution` - Prototype-pollution reflection probe (aggressive)
- `csv_export_csp` - CSV-export formula-injection probe (aggressive)
- `xxe_upload` - XXE via SVG upload probe (aggressive)
- `ssti` - Server-side template injection probe (aggressive)
- `nosql_injection` - NoSQL operator injection probe (aggressive)
- `path_bypass` - Path-normalisation bypass probe (aggressive)
- `ai_prompt_injection_passive` - AI/LLM-plugin prompt-injection surface (#51)
- `postmeta_stored_xss_scan` - post_meta stored-XSS scan via REST (#54)
- `cryptominer_js_injection` - Cryptominer JS injection (#56)
- `magecart_skimmer_patterns` - Magecart / card-skimmer DOM hooks (#57)
- `wp_playground_sqlite` - WP Playground / SQLite database file exposure (A4)
- `interactivity_api_state_leak` - Interactivity-API hydration state PII leak (A6)
- `search_highlight_xss` - Search-result <mark> reflected XSS (A25)
- `wp_query_sqli` - WP_Query/wpdb-specific SQLi (#4) (aggressive)
- `misc_injection_audit` - LDAP/XPath/SSI/ESI/CRLF/email-header (#32-34) (aggressive)
- `wc_cart_abandonment_xss` - WC cart-abandonment plugin XSS probe (F2)
- `global_styles_css_injection` - FSE global-styles CSS-inject probe (F10)
- `interactivity_api_directive_xss` - WP 6.5+ Interactivity API directive-XSS probe (F66)

### SSRF / RCE / open access (23)

- `woocommerce_storefront` - WC coupon-enum throttle + fragments cache-poisoning
- `open_redirect` - Open-redirect probes (aggressive)
- `ssrf` - SSRF probes (aggressive)
- `file_upload` - Upload-endpoint probes (aggressive)
- `core_tampering` - Core file tampering check (aggressive)
- `race_condition` - Race-condition probe (parallel POSTs) (aggressive)
- `cloud_metadata_ssrf` - Cloud-metadata SSRF chain (needs SSRF candidate) (aggressive)
- `dns_rebinding` - DNS-rebinding SSRF probe (aggressive)
- `wp_cron_dos` - wp-cron.php DoS amplification (#2)
- `rest_permission_audit` - REST permission_callback audit (#3)
- `heartbeat_abuse` - Heartbeat API DoS surface (#7)
- `db_trigger_audit` - MySQL trigger audit via companion plugin (#53)
- `wpcron_suspicious_jobs` - Suspicious wp-cron callbacks (companion) (#64)
- `block_bindings_exposure` - Gutenberg Block-Bindings custom-source audit (A5)
- `woo_blocks_checkout_drift` - WooCommerce Store API namespace drift (A9)
- `vercel_preview_url_leak` - Vercel / Netlify preview-URL leak (A16)
- `form_builder_upload_bypass` - Form-builder file-upload bypass advisory (A23)
- `theme_json_font_ssrf` - theme.json font-source SSRF surface (A24)
- `wc_api_key_escalation` - WooCommerce REST key scope advisory (A28)
- `font_library_api_ssrf` - WP 6.5 Font Library SSRF audit (O143)
- `block_style_variations_url` - Block-style URL-prop SSRF (O145)
- `headless_vercel_netlify_detect` - Headless WP on Vercel/Netlify with reachable REST (N138)
- `upload_bypass_deep` - Upload SVG-XXE/polyglot/TOCTOU (#28-30) (aggressive)

### GraphQL & APIs (27)

- `wpgraphql` - WPGraphQL endpoint audit
- `webhooks` - Webhook endpoint discovery
- `xmlrpc_deep` - XML-RPC method enumeration
- `websocket_audit` - WebSocket upgrade + origin audit
- `woocommerce_audit` - WooCommerce REST + legacy-API audit
- `graphql_dos` - GraphQL alias-amplification DoS
- `wp_fork_detection` - WP fork detection (ClassicPress / Bedrock / headless)
- `rest_link_header` - Link: header leaks internal URLs
- `rest_fields_dos` - REST _fields=* DoS amplification probe
- `rest_namespace_leak` - REST namespace internal-name leak
- `ai_chatbot_endpoint_leak` - AI-chatbot REST endpoint PII leak
- `plugin_route_fuzz` - Plugin REST-route fuzzer
- `xmlrpc_method_brute` - XML-RPC hidden-method brute-force (#8)
- `woocommerce_deep` - WC consumer-key/IDOR deep audit (#8+#9)
- `headless_wp_audit` - Headless/API-first WP audit (#87-91)
- `webhook_url_fingerprint` - Webhook URL fingerprint (Discord/Slack/Telegram) (#65)
- `graphql_field_authz_deep` - GraphQL field-level authz deep probe (#70)
- `web3_wallet_connector_audit` - Web3 wallet-connector plugin audit (#71)
- `nft_mint_pubapi` - NFT mint endpoint public-access probe (#72)
- `crypto_payment_callback_audit` - Crypto-payment webhook auth audit (#73)
- `mcp_endpoint_exposure` - MCP (Model Context Protocol) endpoint exposure (A3)
- `rest_schema_field_leak` - REST schema-callback field leak (O144)
- `headless_templates` - Headless DOM templates (Playwright) (#14) (aggressive)
- `websocket_fuzz` - WebSocket frame fuzzer (#23) (aggressive)
- `synced_pattern_leak` - Synced-pattern (block) public-leak probe (F9)
- `rest_only_admin_probe` - REST-only headless /wp-admin lockdown (F15)
- `wc_stores_api_rate_limit_oracle` - WC Stores API cart-add rate-limit probe (F67)

### DNS, email & infra (20)

- `dns_security` - DNS security (SPF/DMARC/DKIM)
- `abuseipdb_lookup` - AbuseIPDB reputation (opt-in)
- `s3_bucket_discovery` - S3 bucket discovery + public-ACL
- `cloudflare_origin_leak` - Cloudflare origin-IP leak via crt.sh + DNS history
- `host_header_validation` - Host-header validation on admin endpoints (DNS-rebinding)
- `github_leak_search` - GitHub leaked-token search (opt-in)
- `hostname_collision` - Apex vs www hostname collision
- `yaml_templates` - YAML templates (nuclei-style) (#9)
- `yaml_workflows` - YAML workflow chaining (#11)
- `dns_templates` - DNS templates (#13)
- `osint_enrich` - OSINT — ASN/geo/bug-bounty/cert TX (#36-43)
- `email_security_deep` - Email deep — DMARC/MTA-STS/BIMI/ARC/DKIM/SPF (#24-31)
- `dns_deep` - DNS deep — DNSSEC/CAA/TXT-secret/DoH/PTR/wildcard (#32-39)
- `cdn_edge_audit` - CDN edge audit — Workers/CF/Fastly/Bunny/KeyCDN (#52-57)
- `service_exposure` - Service-port exposure: Redis/Memcache/DB (#B35-B37)
- `brand_monitor` - Typosquat-of-your-domain brand monitor (#170)
- `pwa_service_worker_cache` - PWA service-worker precaches admin URLs (A18)
- `wp_mail_smtp_site_health_leak` - Site-Health debug dump SMTP-key leak (A26)
- `service_worker_scope_hijack` - Service-worker origin-wide scope (A29)
- `host_platform_detect` - Host stack / platform fingerprint (N136/N139/N140)

### WordPress core, plugins & themes (47)

- `multisite` - WordPress Multisite audit
- `redirect_chain` - Redirect chain analysis
- `error_pages` - Error-page fingerprinting
- `wp_engine_misconfig` - WP Engine private-path leaks
- `page_builder_cve` - Page-builder fingerprint + known-CVE family hint
- `core_cves` - Core CVE matching
- `plugin_cves` - Plugin CVE matching
- `plugin_cemetery` - Abandoned-plugin detector (wp.org last_updated)
- `theme_cves` - Theme CVE matching
- `heartbeat_frontend` - Heartbeat API on front-end
- `wp_cron_disabled` - DISABLE_WP_CRON without replacement
- `wp_cron_cpu` - wp-cron.php response-time amplification
- `object_cache_dropin` - /wp-content/object-cache.php drop-in audit
- `open_registration` - Open registration without membership plugin
- `core_checksums` - WP core file checksums vs wp.org manifest
- `waf_bypass_probe` - WAF bypass/passthrough probe (aggressive)
- `gutenberg_blocks` - Gutenberg block CVE scanner (#1)
- `wp_salts_age` - WP salts age check (#5+#6)
- `plugin_specific_audit` - ACF/MS/agent/child/WP-CLI audit (#11-15)
- `hosting_platform_audit` - WP Engine/Kinsta/CF/Amplify audits (#16-22)
- `wp_builder_audit` - Block-theme/FSE + page-builder audit (#1-2)
- `wp_form_audit` - Form-plugin deep audit (CF7/WPF/GF/NF/FF/Formidable) (#3)
- `wp_membership_lms_audit` - Membership + LMS plugin audit (#4-5)
- `wp_commerce_alt_audit` - Alt-commerce + booking-plugin audit (#6+8)
- `wp_plugin_ecosystem_audit` - Search/SEO/Backup/SMTP/Cache/CDN/Sec/Chat plugin audit (#7,#9-15)
- `wp_multisite_deep` - WP-Multisite per-blog deep audit (#17)
- `wp_cli_inject` - WP-CLI command-injection probe (#B28) (aggressive)
- `wpconfig_hardening_audit` - wp-config hardening inferred from remote signals (#52)
- `vendor_backdoor_patterns` - Known-bad / vendor-backdoor plugin slugs (#55)
- `plugin_typosquat_detection` - Plugin slug typosquat detection (#58)
- `ai_plugin_prompt_storage` - AI plugin prompt-injection surface (A1)
- `wp_cli_http_exposure` - WP-CLI-over-HTTP endpoint exposure (A7)
- `woo_subscriptions_renewal_race` - WC Subscriptions duplicate-renewal race patch audit (A10)
- `stripe_webhook_audit` - Stripe / WooPayments webhook signature audit (A11)
- `amp_transitional_redirect` - AMP plugin transitional-mode open-redirect (A19)
- `translation_plugin_key_leak` - Translation plugin API key leak (A27)
- `speculation_rules_audit` - WP 6.8 Speculation Rules audit (O141)
- `companion_v13` - Companion v1.3 endpoint consumers (B36-B47)
- `companion_v14` - Companion v1.4 endpoint consumers (B38-B45)
- `plugin_archive_fuzz` - Plugin source-archive fuzz (#6) (aggressive)
- `wc_coupon_enum` - WC coupon-code enumeration oracle (F1)
- `wc_draft_order_escalation` - WC draft-order state-machine probe (F3)
- `plugin_update_server_integrity` - Plugin update-server HTTPS audit (F6)
- `activitypub_data_leak` - ActivityPub actor PII leak probe (F8)
- `wc_multivendor_idor` - WC multi-vendor (Dokan/WCFM) IDOR probe (F19)
- `wc_refund_flow_idor` - WC refund-flow IDOR probe (F23)
- `wc_hpos_namespace_drift` - WC HPOS namespace-drift advisory (F68)

### Privacy, compliance & accessibility (16)

- `gdpr_dsr` - GDPR Data-Subject-Request audit
- `a11y_lite` - Accessibility smoke check
- `sitemap_cve_probe` - Sitemap-driven CVE pattern probe
- `gtm_inventory` - Google Tag Manager container inventory
- `rum_beacons` - RUM beacon library detection
- `email_obfuscation_audit` - Email obfuscation + raw-address leak audit
- `dom_xss_headless` - Headless DOM-XSS (Playwright, opt-in) (aggressive)
- `privacy_inventory` - Privacy/GDPR data + tracker inventory (#16-23)
- `payment_commerce_deep` - Payment/PCI 4.0 deep audit (#58-62)
- `compliance_frameworks` - Compliance framework mapping — HITRUST/CMMC/NIST CSF/CIS/ISO (#63-67)
- `honeypot_admin` - Honeypot / anti-spam detection (#19)
- `a11y_deep` - WCAG 2.2 accessibility deep audit (#24)
- `perf_budget` - Performance-budget audit (#25)
- `a11y_wcag_aaa` - WCAG 2.2 AAA-level accessibility extras (#99)
- `ai_agent_webhook_leak` - AI chatbot relay-endpoint / key leak (A2)
- `ai_agent_tool_injection` - WP AI-agent tool-call injection probe (F18)

### Other (12)

- `js_libraries` - JS library version audit
- `js_supply_chain` - External JS supply-chain audit
- `waf_lockout_guard` - Early-abort guard: avoid IP-ban escalation when WAF blocks the first probe
- `php_eol` - PHP end-of-life audit
- `debug_log_pii_sniff` - debug.log PII content sniff
- `xmlrpc_amplification` - xmlrpc.php multicall amplification ratio
- `webhook_signing_secrets` - Payment-webhook signing-secret leak
- `algolia_elastic_frontend_keys` - Algolia / ES write-key leak in frontend JS (A14)
- `turnstile_sitekey_reuse` - Captcha sitekey placeholder / domain audit (A32)
- `admin_invite_link_scan` - Discord/Slack/Telegram invite leak (A33)
- `wp_auto_update_filter_exposure` - Public auto-update state exposure (F7)
- `multisite_network_option_idor` - Multisite network-option IDOR probe (F11)