WPScan
WordPress security scanner for vulnerability detection and enumeration
Web Vulnerabilities10 commands
#wordpress#cms#scanner#vulnerability
Installation
1Install via gem
2Install dependencies
3Verify installation
# Using gem
gem install wpscan
# Verify
wpscan --versionBasic Usage
Enumerate WordPress vulnerabilities, users, plugins, and themes
# Basic scan
wpscan --url https://target.com
# Enumerate users
wpscan --url https://target.com --enumerate u
# With API token for better results
wpscan --url https://target.com --api-token TOKENCommand Reference
10 commands
1Target WordPress URL
--url2Enumerate (u=users, p=plugins, t=themes)
--enumerate3WPVulnDB API token for live data
--api-token4Password brute forcing (xmlrpc, wp-login)
--password-attack5Plugin version detection mode
--plugins-version-detection6Output to file
-o7Output format (cli, json, etc.)
--format8Proxy for requests
--proxy9Cookie string for authentication
--cookie10Randomize user agent
--random-user-agentWhen to Use
1
WordPress reconnaissance and security auditing2
Vulnerability scanning for known CVEs3
User enumeration for brute force targets4
Plugin and theme version checking5
Password brute forcing on WordPress sitesNotes & Tips
1
API token from WPVulnDB required for real-time vulnerability data2
Rate limiting may apply; use --throttle flag if needed3
Works best with full access to the target siteCommon Errors & Solutions
Connection refused
Ensure the target URL is correct and reachable
API token required
Register at wpvulndb.com and use --api-token
Too many redirects
Use --follow-redirection or check URL format