Threat Intel

43% of all websites run WordPress — making it the #1 attack surface worldwide 1 in 25 WordPress sites is actively infected with malware right now 97% of CMS-based attacks specifically target WordPress plugins & themes 50,000+ vulnerabilities indexed · WPScan threat database 71% of hacked WordPress sites had a backdoor silently installed 4,000+ plugins carry known, unpatched security vulnerabilities Average breach goes undetected for 197 days — is your site clean? Outdated plugins are responsible for 52% of all WordPress infections SQL injection & XSS remain the top two WordPress attack vectors 60% of infections exploit a vulnerability that already had a patch available 43% of all websites run WordPress — making it the #1 attack surface worldwide 1 in 25 WordPress sites is actively infected with malware right now 97% of CMS-based attacks specifically target WordPress plugins & themes 50,000+ vulnerabilities indexed · WPScan threat database 71% of hacked WordPress sites had a backdoor silently installed 4,000+ plugins carry known, unpatched security vulnerabilities Average breach goes undetected for 197 days — is your site clean? Outdated plugins are responsible for 52% of all WordPress infections SQL injection & XSS remain the top two WordPress attack vectors 60% of infections exploit a vulnerability that already had a patch available

Get started

WordPress Plugin Security Scanner

WordPress plugins are the #1 attack surface for WordPress sites — they're installed by millions of sites and written by developers with varying security expertise. Before installing a custom or premium plugin, upload the ZIP here to scan its PHP, JavaScript, and HTML files for SQL injection, XSS, file inclusion, command injection, hardcoded credentials, and 40+ other vulnerability patterns.

What wp-scan.org detects

✓ SQL injection via unsanitized input in custom queries
✓ Cross-site scripting in plugin front-end output
✓ Local and remote file inclusion vulnerabilities
✓ Hardcoded API keys, passwords, or database credentials
✓ CSRF vulnerabilities — missing nonce checks on admin actions
✓ Insecure direct object references in AJAX handlers

Scan your WordPress files now — free

Want to see what a Premium report looks like?

View a real scan with line numbers, fix guides, and secure code for every finding.

View sample report →

Common questions

See exact line numbers and fix guides for every finding

Upgrade to Premium — from $9.99/mo →