Marcus Downing

<p>This plugin adds an admin page under the Tools section that reports on any known vulnerabilities in your version of WordPress and any installed themes or plugins.</p>
<p>This information is only visible to administrators (or more precisely, those with the <code>manage_options</code> capability). Subscribers, authors and editors cannot see the data.</p>
<h3>Source</h3>
<p>The information this plugin uses comes from the WPScan Vulnerability Database: https://wpvulndb.com/. It uses a cache and internal throttling to ensure its use of the API is not excessive or abusive.</p>
<h3>Note</h3>
<p>Using this plugin does not guarantee that your site has no vulnerabilities. It also does not absolve you from responsibilities as a site owner to secure your site in other ways, such as SSL or host security. This plugin is only a tool; using it responsibly is up to you.</p>
<h3>WP-CLI</h3>
<p>This plugin registers a WP-CLI command, that allows you to scan from the command line. The response codes are compatible with Nagios (1 for critical error, 2 for warning, 3 for unknown).</p>
<ul>
<li><code>wp vuln scan</code>, to report all known vulnerabilities.</li>
<li><code>wp vuln plugins</code>, to report only vulnerabilities in plugins.</li>
<li><code>wp vuln themes</code>, to report only vulnerabilities in themes.</li>
<li><code>wp vuln wp</code>, to report only vulnerabilities in WordPress core.</li>
<li><code>wp vuln details</code>, to show a more detailed output on known vulnerabilities.</li>
<li><code>wp vuln clear</code>, to clear the internal cache of vulnerability data. This will result in making extra requests to the API, and is probably not needed.</li>
</ul>


Bang Vulnerability Scanner

Reports if your WordPress site has any known vulnerabilities.

Jaroslav Svetlik

<p>VulnTitan is a WordPress security plugin focused on malware scanning and removal, vulnerability detection, file integrity monitoring, firewall protection, and anti-spam controls for comments and supported forms.</p>
<p>Instantly scan your WordPress site for malware infections and known vulnerabilities, review detailed results, and clean or remove malware safely using a guided fix workflow with automatic backups.</p>
<p>VulnTitan focuses on practical protection: vulnerability detection, malware scanning and removal, file integrity monitoring, firewall protection, anti-spam defense for comments and supported forms, hidden custom login access, and a weekly executive security digest every 7 days.</p>
<h4>Malware Scanner</h4>
<p>The WordPress malware scanner inspects your site files for suspicious code patterns and known malicious signatures.</p>
<ul>
<li>Detect malware infections in core, plugins, and themes</li>
<li>Review problematic files with contextual code preview</li>
<li>Safe-fix workflow with automatic backups</li>
<li>Clear severity indicators and actionable recommendations</li>
</ul>
<h4>Vulnerability Scanner</h4>
<p>The vulnerability scanner checks your installed WordPress core, plugins, and themes against a real-time vulnerability database powered by the VulnTitan API.</p>
<ul>
<li>Detect vulnerable plugins and themes</li>
<li>Identify outdated components with known security risks</li>
<li>Real-time vulnerability intelligence</li>
<li>Clear risk explanations and remediation guidance</li>
</ul>
<h4>File Integrity Scanner</h4>
<p>Monitor unauthorized file changes and unexpected modifications.</p>
<ul>
<li>Baseline comparison for WordPress files</li>
<li>Queue-based processing for performance safety</li>
<li>Visual status legends for fast review</li>
<li>Actionable next steps for suspicious changes</li>
</ul>
<h4>Firewall, Login, Comment & Form Protection</h4>
<p>VulnTitan includes firewall, WAF, login protection, and anti-spam controls to block common attack patterns and protect WordPress login, comment, and supported form submission surfaces.</p>
<ul>
<li>Early MU-plugin runtime request guards</li>
<li>SQL injection (SQLi) payload protection</li>
<li>Command injection detection</li>
<li>Suspicious path traversal blocking</li>
<li>Endpoint whitelisting controls</li>
<li>Login lockout protection against brute-force attacks</li>
<li>TOTP-based two-factor authentication for selected roles</li>
<li>Recovery codes and trusted-device support for enrolled accounts</li>
<li>CAPTCHA protection for login, registration, lost-password, and optional comment forms</li>
<li>XML-RPC allow, disable, or rate-limit policy controls with IP allowlisting</li>
<li>Weak-password blocking during profile updates, password resets, and compatible registrations</li>
<li>Comment Shield with honeypot, signed tokens, submit-time validation, duplicate detection, guest link limits, IP rate limiting, and moderation-aware logging</li>
<li>Form Shield for Contact Form 7 and Fluent Forms with honeypot, signed submit tokens, link heuristics, repeated-domain detection, and IP rate limiting</li>
<li>Form spam blocks are logged into the WAF/live feed with provider-aware source labels for easier review</li>
<li>Suspicious comments can be held for moderation or blocked immediately</li>
<li>REST comments can enforce signed anti-spam tokens and CAPTCHA when anonymous REST commenting is enabled elsewhere</li>
<li>Configurable custom login slug so administrators can use a private login URL instead of the default <code>wp-login.php</code></li>
<li>Default <code>wp-login.php</code> and guest <code>wp-admin</code> access can be hidden behind a <code>404</code> response when custom login is enabled</li>
<li>Weekly executive security report email with 7-day firewall, login abuse, WAF, form spam, and comment moderation statistics</li>
</ul>
<h4>Security-First Architecture</h4>
<ul>
<li>Secure storage and cleanup of scan queues and logs</li>
<li>Hardened backup handling outside <code>ABSPATH</code> by default</li>
<li>Hardened malware and integrity scan actions with stricter capability checks and in-root path validation</li>
<li>Adaptive performance tuning for safe large-site scanning</li>
</ul>
<h4>WP-CLI Support</h4>
<p>VulnTitan supports WP-CLI commands for malware, integrity, and vulnerability scans so administrators can run checks from the terminal, scripts, or server automation.</p>
<ul>
<li><code>wp vulntitan scan malware</code></li>
<li><code>wp vulntitan scan integrity</code></li>
<li><code>wp vulntitan scan vulnerability</code></li>
<li><code>wp vulntitan scan all</code></li>
<li>Optional flags: <code>--scope=plugins</code>, <code>--format=json</code>, <code>--fail-on-findings</code></li>
</ul>
<h3>External services</h3>
<p>This plugin connects to an external API at https://vulntitan.com/api/vulnerabilities to fetch up-to-date vulnerability data for WordPress core, plugins, and themes. This data is essential for detecting known vulnerabilities during scan operations.</p>
<p>When a vulnerability scan is performed, the following data is sent to the VulnTitan API:<br />
– The slug and version of each plugin<br />
– The slug and version of each theme<br />
– The WordPress core version</p>
<p>This data is transmitted only during scans initiated by the user or by scheduled scan settings. No personal, user-identifying, or sensitive site data is collected, transmitted, or stored.</p>
<p>The external service is provided and operated by VulnTitan.com.</p>
<ul>
<li>Terms of Service: https://vulntitan.com/terms</li>
<li>Privacy Policy: https://vulntitan.com/privacy</li>
</ul>


VulnTitan – Malware Scanner, Vulnerability Scanner & Security

VulnTitan security toolkit for WordPress sites. Detect and remove malware, vulnerable plugins, risky file changes, and comment or form spam.

Bang Vulnerability Scanner vs VulnTitan – Malware Scanner, Vulnerability Scanner & Security