Unrestricted file upload allows authenticated attackers to upload executable files via the form-mail attachment field. A contributor-tier account is sufficient.
Find vulnerable WordPress plugins
before attackers do.
CoreScanWP cross-checks every detected plugin and theme against the NIST National Vulnerability Database. Critical, high, and medium severity issues are flagged with a fix version and a direct link to the advisory.
How vulnerability detection works.
Three steps. No plugin name, no URL, no scan result is ever sent to a third party.
-
1
Detect what's installed
CoreScanWP reads the homepage, crawls inner pages, and probes ~230 popular plugin readme files to surface every plugin and theme with a confirmed version.
-
2
Cross-check against the CVE feed
Each detected name + version is matched against the public NIST National Vulnerability Database feed. The lookup happens against the copy held in your browser, refreshed on every scanner upgrade, so the match runs at
readme.txtspeed. -
3
Flag by severity, link to the advisory
Matches are rendered inline with a severity pill (critical / high / medium / low), the CVE id, the CVSS score, the fix version, and a direct link to the official advisory. Patched plugins do not appear.
What a finding looks like.
Three example CVE records from the WordPress plugin ecosystem. Each is the kind of entry CoreScanWP surfaces on a match — severity band, CVE id, CVSS score, publication date, and a direct link to the advisory.
Severity reference.
CoreScanWP reports the CVSS 3.1 base score and the band it falls into, so you can triage findings without having to look anything up.
Unauthenticated remote code execution, authentication bypass, full site takeover. Patch on the same day you scan.
Authenticated remote code execution, privilege escalation, stored XSS in admin views. Patch within the week.
SQL injection requiring elevated privileges, reflected XSS, information disclosure. Patch with your normal release cadence.
Minor information leaks, low-impact CSRF, edge-case denial-of-service. Patch on your next maintenance window.
Where the data comes from.
One open, government-run vulnerability feed. No proprietary data, no pay-wall, refreshed on every CoreScanWP upgrade.
NIST National Vulnerability Database
The US-government-run CVE feed. The CVSS 3.1 base score WP Scanner reports is the authoritative score from NVD, not a re-calculation. CoreScanWP filters NVD to entries whose CPE targets WordPress and has a known fix version.
nvd.nist.govCross-checks happen in your browser. No plugin list, URL, or scan result is ever sent to a third-party server.