CoreScanWP v1.4

Find vulnerable WordPress plugins
before attackers do.

CoreScanWP cross-checks every detected plugin and theme against the NIST National Vulnerability Database. Critical, high, and medium severity issues are flagged with a fix version and a direct link to the advisory.

How vulnerability detection works.

Three steps. No plugin name, no URL, no scan result is ever sent to a third party.

  1. 1

    Detect what's installed

    CoreScanWP reads the homepage, crawls inner pages, and probes ~230 popular plugin readme files to surface every plugin and theme with a confirmed version.

  2. 2

    Cross-check against the CVE feed

    Each detected name + version is matched against the public NIST National Vulnerability Database feed. The lookup happens against the copy held in your browser, refreshed on every scanner upgrade, so the match runs at readme.txt speed.

  3. 3

    Flag by severity, link to the advisory

    Matches are rendered inline with a severity pill (critical / high / medium / low), the CVE id, the CVSS score, the fix version, and a direct link to the official advisory. Patched plugins do not appear.

What a finding looks like.

Three example CVE records from the WordPress plugin ecosystem. Each is the kind of entry CoreScanWP surfaces on a match — severity band, CVE id, CVSS score, publication date, and a direct link to the advisory.

Critical Contact Form 7 Advisory

Unrestricted file upload allows authenticated attackers to upload executable files via the form-mail attachment field. A contributor-tier account is sufficient.

CVECVE-2020-35489 CVSS9.8 Published2020-12-17
High Elementor Advisory

Authenticated remote code execution via the file upload endpoint. Affects all installs with a contributor-tier user.

CVECVE-2022-1329 CVSS8.8 Published2022-04-12
Medium WooCommerce Advisory

SQL injection in the admin order-search parameter. Requires shop_manager privileges. Patched in the same-day point release.

CVECVE-2022-2640 CVSS6.4 Published2022-07-15

Severity reference.

CoreScanWP reports the CVSS 3.1 base score and the band it falls into, so you can triage findings without having to look anything up.

Critical 9.0 – 10.0

Unauthenticated remote code execution, authentication bypass, full site takeover. Patch on the same day you scan.

High 7.0 – 8.9

Authenticated remote code execution, privilege escalation, stored XSS in admin views. Patch within the week.

Medium 4.0 – 6.9

SQL injection requiring elevated privileges, reflected XSS, information disclosure. Patch with your normal release cadence.

Low 0.1 – 3.9

Minor information leaks, low-impact CSRF, edge-case denial-of-service. Patch on your next maintenance window.

Where the data comes from.

One open, government-run vulnerability feed. No proprietary data, no pay-wall, refreshed on every CoreScanWP upgrade.

NIST National Vulnerability Database

The US-government-run CVE feed. The CVSS 3.1 base score WP Scanner reports is the authoritative score from NVD, not a re-calculation. CoreScanWP filters NVD to entries whose CPE targets WordPress and has a known fix version.

nvd.nist.gov

Cross-checks happen in your browser. No plugin list, URL, or scan result is ever sent to a third-party server.