Updated Jul 15, 2026
Scanners
Enumerate WordPress plugins, themes, and users
WordPress scanner for plugins, themes, users, and known vulns.
overview
What wpscan does
wpscan fingerprints a WordPress site at --url, then enumerates plugins, themes, users, and interesting files against its vulnerability database.
Select coverage with --enumerate codes such as vp, vt, and u. --stealthy and --detection-mode trade breadth for quieter passive checks.
Confirmed WordPress only. For many URLs in one pass use wpscan-loop; for non-WordPress apps prefer nuclei templates.
source github.com/wpscanteam/wpscan
use cases
Where wpscan fits
Audit a WordPress blog for known vulns
Run against a single --url with an --api-token so plugin and theme versions map to vulnerability data.
Enumerate users before credential testing
Use --enumerate u to recover author IDs and usernames that feed a later password attack or phishing check.
Quiet passive fingerprint of plugins
Enable --stealthy or --plugins-detection passive when you need coverage without aggressive probing.
Export structured findings for a pipeline
Set --format json so downstream nodes can parse plugins, themes, and users without scraping CLI text.
reference
wpscan inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | --url | The URL of the blog to scan (http or https). Mandatory. |
| enumerate | STRING | --enumerate | Enumeration process: vp, ap, p, vt, at, t, tt, cb, dbe, u, m (comma separated). |
| api-token | STRING | --api-token | WPScan API token used to display vulnerability data. |
| format | STRING | --format | Output format: cli, json, cli-no-colour, or cli-no-color. |
| stealthy | BOOLEAN | --stealthy | Quiet profile: random UA, passive detection, passive plugin version checks. |
| detection-mode | STRING | --detection-mode | Global detection mode: mixed, passive, or aggressive (default mixed). |
| plugins-detection | STRING | --plugins-detection | Plugin enumeration mode: mixed, passive, or aggressive (default passive). |
| max-threads | STRING | --max-threads | Maximum concurrent threads (default 5). |
Showing key inputs. wpscan exposes 68 inputs in total.
Full flag reference (68 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | --url | The URL of the blog to scan. Allowed Protocols: http, https. Default Protocol if none provided: http. This option is mandatory. |
| force | BOOLEAN | --force | Do not check if the target is running WordPress or returns a 403 |
| proxy | STRING | --proxy | Format: protocol://IP:port |
| scope | STRING | --scope | 'Comma separated (sub-)domains to consider in scope. Wildcard(s) allowed in the trd of valid domains, e.g: *.target.tld. Separator to use between the values: ',' |
| vhost | STRING | --vhost | The virtual host (Host header) to use in requests |
| format | STRING | --format | Output results in the format supplied. Available choices: cli, json, cli-no-colour, cli-no-color |
| server | STRING | --server | Force the supplied server module to be loaded. Available choices: apache, iis, nginx |
| headers | STRING | --headers | Additional headers to append in requests |
| verbose | BOOLEAN | --verbose | Verbose mode |
| stealthy | BOOLEAN | --stealthy | Alias for --random-user-agent --detection-mode passive --plugins-version-detection passive |
| throttle | STRING | --throttle | Milliseconds to wait before doing another web request. If used, the max threads will be set to 1. |
| api-token | STRING | --api-token | The WPScan API Token to display vulnerability data, available at https://wpscan.com/profile |
| cache-dir | STRING | --cache-dir | Default: /tmp/wpscan/cache |
| enumerate | STRING | --enumerate | Enumeration Process. Available Choices: vp (Vulnerable plugins), ap (All plugins), p (Popular plugins), vt (Vulnerable themes), at (All themes), t (Popular themes), tt (Timthumbs), cb (Config backups), dbe (Db exports), u (User IDs range. e.g: u1-5. Range separator to use: '-'. Value if no argument supplied: 1-10), m (Media IDs range. e.g m1-15. Note: Permalink setting must be set to 'Plain' for those to be detected. Range separator to use: '-'. Value if no argument supplied: 1-100). Separator to use between the values: ','. Default: All Plugins, Config Backups. Value if no argument supplied: vp,vt,tt,cb,dbe,u,m. |
| http-auth | STRING | --http-auth | Format: login:password |
| login-uri | STRING | --login-uri | The URI of the login page if different from /wp-login.php |
| no-banner | BOOLEAN | --no-banner | Don't display the banner |
| no-update | BOOLEAN | --no-update | Do not update the Database. |
| passwords | FILE | --passwords | List of passwords to use during the password attack. If no --username/s option supplied, user enumeration will be run. |
| proxy-auth | STRING | --proxy-auth | Format: login:password |
| user-agent | STRING | --user-agent | User agent |
| clear-cache | BOOLEAN | --clear-cache | Clear the cache before the scan |
| max-threads | STRING | --max-threads | The max threads to use. Default: 5 |
| cookie-string | STRING | --cookie-string | Cookie string to use in requests, format: cookie1=value1[; cookie2=value2 |
| detection-mode | STRING | --detection-mode | Default: mixed. Available choices: mixed, passive, aggressive |
| timthumbs-list | FILE | --timthumbs-list | List of timthumbs' location to use |
| usernames-file | FILE | --usernames | List of usernames to use during the password attack. |
| wp-content-dir | STRING | --wp-content-dir | The wp-content directory if custom or not detected, such as "wp-content" |
| wp-plugins-dir | STRING | --wp-plugins-dir | The plugins directory if custom or not detected, such as "wp-content/plugins" |
| wp-version-all | BOOLEAN | --wp-version-all | Check all the version locations |
| db-exports-list | FILE | --db-exports-list | List of DB exports' paths to use |
| password-attack | STRING | --password-attack | Force the supplied attack to be used rather than automatically determining one. Multicall will only work against WP < 4.4. Available choices: wp-login, xmlrpc, xmlrpc-multicall |
| request-timeout | STRING | --request-timeout | The request timeout in seconds. Default: 60 |
| users-detection | STRING | --users-detection | Use the supplied mode to enumerate Users, instead of the global (--detection-mode) mode. Available choices: mixed, passive, aggressive |
| users-list-file | FILE | --users-list | List of users to check during the users enumeration from the Login Error Messages |
| medias-detection | STRING | --medias-detection | Use the supplied mode to enumerate Medias, instead of the global (--detection-mode) mode. Available choices: mixed, passive, aggressive |
| themes-detection | STRING | --themes-detection | Use the supplied mode to enumerate Themes, instead of the global (--detection-mode) mode. Available choices: mixed, passive, aggressive |
| themes-list-file | FILE | --themes-list | List of themes to enumerate. |
| themes-threshold | STRING | --themes-threshold | Raise an error when the number of detected themes via known locations reaches the threshold. Set to 0 to ignore the threshold. Default: 20 |
| user-agents-list | FILE | --user-agents-list | List of agents to use with --random-user-agent |
| usernames-string | STRING | --usernames | List of usernames to use during the password attack. Examples: 'a1', 'a1,a2,a3' |
| exclude-usernames | STRING | --exclude-usernames | Exclude usernames matching the Regexp/string (case insensitive). Regexp delimiters are not required. |
| max-scan-duration | STRING | --max-scan-duration | Abort the scan if it exceeds the time provided in seconds |
| plugins-detection | STRING | --plugins-detection | Use the supplied mode to enumerate Plugins. Default: passive. Available choices: mixed, passive, aggressive |
| plugins-list-file | FILE | --plugins-list | List of plugins to enumerate. |
| plugins-threshold | STRING | --plugins-threshold | Raise an error when the number of detected plugins via known locations reaches the threshold. Set to 0 to ignore the threshold. Default: 100 |
| random-user-agent | BOOLEAN | --random-user-agent | Additional headers to append in requests. Separator to use between the headers: '; '. Examples: 'X-Forwarded-For: 127.0.0.1', 'X-Forwarded-For: 127.0.0.1; Another: aaa' |
| users-list-string | STRING | --users-list | List of users to check during the users enumeration from the Login Error Messages. Examples: 'a1', 'a1,a2,a3' |
| cache-time-to-live | STRING | --cache-ttl | The cache time to live in seconds. Default: 600 |
| connection-timeout | STRING | --connect-timeout | The connection timeout in seconds. Default: 30 |
| disable-tls-checsk | BOOLEAN | --disable-tls-checks | Disables SSL/TLS certificate verification, and downgrade to TLS1.0+ (requires cURL 7.66 for the latter) |
| themes-list-string | STRING | --themes-list | List of themes to enumerate. Examples: 'a1', 'a1,a2,a3' |
| themes-version-all | BOOLEAN | --themes-version-all | Check all the themes version locations according to the choosen mode (--detection-mode, --themes-detection and --themes-version-detection) |
| config-backups-list | FILE | --config-backups-list | List of config backups' filenames to use' |
| plugins-list-string | STRING | --plugins-list | List of plugins to enumerate. Examples: 'a1', 'a1,a2,a3' |
| plugins-version-all | STRING | --plugins-version-all | Check all the plugins version locations according to the choosen mode (--detection-mode, --plugins-detection and --plugins-version-detection) |
| timthumbs-detection | STRING | --timthumbs-detection | Use the supplied mode to enumerate Timthumbs, instead of the global (--detection-mode) mode. Available choices: mixed, passive, aggressive |
| db-exports-detection | STRING | --db-exports-detection | Use the supplied mode to enumerate DB Exports, instead of the global (--detection-mode) mode. Available choices: mixed, passive, aggressive |
| ignore-main-redirect | BOOLEAN | --ignore-main-redirect | Ignore the main redirect (if any) and scan the target url |
| main-theme-detection | STRING | --main-theme-detection | Use the supplied mode for the Main theme detection, instead of the global (--detection-mode) mode. Available choices: mixed, passive, aggressive |
| wp-version-detection | STRING | --wp-version-detection | Use the supplied mode for the WordPress version detection, instead of the global (--detection-mode) mode. Available choices: mixed, passive, aggressive |
| exclude-content-based | STRING | --exclude-content-based | Exclude all responses matching the Regexp (case insensitive) during parts of the enumeration. Both the headers and body are checked. Regexp delimiters are not required. |
| multicall-max-passwords | STRING | --multicall-max-passwords | Maximum number of passwords to send by request with XMLRPC multicall. Default: 500 |
| config-backups-detection | STRING | --config-backups-detection | Use the supplied mode to enumerate Config Backups, instead of the global (--detection-mode) mode. Available choices: mixed, passive, aggressive |
| themes-version-detection | STRING | --themes-version-detection | Use the supplied mode to check themes versions instead of the --detection-mode or --themes-detection modes. Available choices: mixed, passive, aggressive |
| file-to-read-write-cokies | FILE | --cookie-jar | File to read and write cookies |
| plugins-version-detection | STRING | --plugins-version-detection | Use the supplied mode to check plugins versions. Default: mixed. Available choices: mixed, passive, aggressive |
| interesting-findings-detection | STRING | --interesting-findings-detection | Use the supplied mode for the interesting findings detection. Available choices: mixed, passive, aggressive |
example
Run wpscan
# enumerate vulnerable plugins/themes and users on a WordPress sitewpscan --url https://example.com --enumerate vp,vt,u --format json --no-update[+] URL: https://example.com/[+] Started: Wed Jul 15 12:00:00 2026[+] Interesting Finding(s): | WordPress version 6.4.2 identified[+] Enumerating Vulnerable Plugins | Name: akismet - v5.3[+] Enumerating Users | id: 1 | login: admin[+] Finished: https://example.com/guidance
Choosing wpscan
Use when the target is confirmed WordPress and you want plugin, theme, user, and vuln coverage in one pass. For many WordPress URLs use wpscan-loop. For other stacks use nuclei.
wpscan-loop
Same scanner over a file of URLs. Prefer it when you have many WordPress sites instead of one --url.
nuclei
Template scanner across any stack. Broader coverage; not WordPress-specialized like wpscan.
faq
wpscan questions
Pass --url https://example.com and optionally --enumerate vp,vt,u. On Trickest set the url and enumerate inputs on the wpscan node.
related
More Scanners tools
ac-scanner
BHUSA Arsenal TLS/SSH crypto inventory with post-quantum readiness signals and CBOM-shaped output.
airixss
Reflection triage for parameter URLs during recon.
bedrock-keys-security
Black Hat Arsenal hunting for phantom IAM users behind Bedrock keys, with offline key decode and org scan.
cmseek
CMS detection and version fingerprinting.
jaeles
Signature-driven web application scanner.
joomscan
OWASP Joomla vulnerability scanner for CMS flaws and misconfigurations.
Run wpscan yourself
A blog URL feeds wpscan, which enumerates plugins, themes, and users, checks them against the vulnerability database, and writes the findings as a queryable output.
Facts on this page come from the live Trickest tool library.