InspectWP Logo

WordPress Vulnerability Scanner

Please provide a valid URL (https://www.example.com).
HTTP Basic Auth For password-protected websites (.htaccess)
Premium Plan Feature
Upgrade

Known vulnerabilities in your WordPress plugins, found from the outside

Online scan without installation, results in under a minute
Thousands of website owners and agencies rely on InspectWP for their WordPress security check

What does the WordPress Vulnerability Scanner check?

Installed plugins and their versions, detected from the outside

Plugins, theme and WordPress core matched against the Wordfence Intelligence vulnerability database

CVSS score and severity for every finding

The plugin version in which the vulnerability is fixed

Abandoned plugins and plugins removed from the WordPress directory

WordPress core version and its security update status

How the WordPress vulnerability scan works

From URL to prioritized update list in 4 steps

  1. 1 Step 1

    Enter URL

    Enter the address of the WordPress site. No plugin, no FTP access and no login required.

  2. 2 Step 2

    Detect plugins and versions

    We load the page in a real browser, identify the active plugins and determine their versions from several sources.

  3. 3 Step 3

    Match against the database

    Every detected version is compared with the known vulnerabilities from Wordfence Intelligence, including CVSS score and severity.

  4. 4 Step 4

    Update affected plugins

    The report names the fixed version for every finding. Update the plugins with the highest severity first.

Severity levels in the vulnerability report

Every finding carries a CVSS score from 0 to 10 that tells you how urgent the update is

  • Critical

    CVSS 9.0 to 10.0

    Can usually be exploited without a login and often leads to a full takeover of the website. Update immediately or deactivate the plugin until a fix is available.

  • High

    CVSS 7.0 to 8.9

    Serious impact, for example access to data or the injection of malicious code. Often requires a low-privileged account such as a subscriber. Update as soon as possible.

  • Medium

    CVSS 4.0 to 6.9

    Exploitable only under certain conditions, for example when a logged-in user clicks a prepared link. Schedule the update for your next maintenance window.

  • Low

    CVSS 0.1 to 3.9

    Limited impact or hard to exploit. Not a reason to panic, but it is resolved with the next regular plugin update.

How to read the scan result

The report distinguishes clearly between what is certain and what is not

Affected
The installed version was confirmed and a vulnerability is documented for exactly this version. The report shows severity, CVSS score, the fixed version and a link to the record.
Possibly affected
A vulnerability is documented for the plugin, but the installed version could not be determined beyond doubt. The finding is shown as a warning so that you can verify the version yourself.
Note without practical impact
Some database records describe issues with extremely limited or no real-world impact. They are listed for completeness but do not affect the rating of your website.
Not scannable
If no version can be detected for plugins, theme or WordPress, the report says so openly instead of reporting zero vulnerabilities. A scan without versions is not a clean result.

What is included in the free report?

The free report detects your plugins and theme and warns you about abandoned plugins, plugins removed from the WordPress directory and an outdated WordPress version. Plugin versions and the match of plugins, theme and WordPress against the vulnerability database are included in the Premium and Agency plans.

Compare plans

WordPress Vulnerability Scanner: plugin vulnerabilities at a glance

Find vulnerable WordPress plugins before attackers do

Most hacked WordPress sites were not broken into through WordPress itself but through a plugin with a publicly documented vulnerability. The InspectWP Vulnerability Scanner loads your page the way a visitor would, identifies the plugins that are active on it and works out which version is installed. Each detected version is then compared with the Wordfence Intelligence vulnerability database. For every match you see the severity, the CVSS score and the version that closes the gap, so you know exactly which update comes first.

How reliable is a vulnerability scan from the outside?

A remote scan only sees what your website reveals. InspectWP therefore reads the plugin version from several independent sources, for example the readme.txt, the changelog, version signatures in the HTML and script configuration. If at least two sources agree, the version counts as confirmed and a match is reported as affected. If only one source is available, the report says possibly affected instead of claiming certainty. Plugins that load nothing on the scanned page stay invisible from the outside. If you connect your site with the InspectWP WordPress plugin, the scanner works with the complete plugin list and the exact versions.

WordPress vulnerability check: version detection and database match

Thousands of website owners trust InspectWP

The numbers speak for themselves

0+
Websites analyzed
0+
Plugins detected
0+
Themes detected

Frequently asked questions about the WordPress Vulnerability Scanner

What the scan covers, where its limits are and what to do with the results

You enter a URL and InspectWP loads the page in a real browser. From the loaded stylesheets, scripts and HTML markers we derive which plugins are active and which version is installed. These versions are compared with the Wordfence Intelligence vulnerability database. Nothing is installed on your site and no login is needed.

More tools you might need

These checks cover related topics

Your registration could not be saved. Please try again.
Your registration was successful.

Newsletter

Subscribe to our newsletter to stay up to date.

We use Sendinblue as our marketing platform. By completing and submitting the form, you acknowledge that the information you have provided will be sent to Sendinblue for processing in accordance with Terms of Use.