Scan a list of WordPress sites for known issues

wpscan-loop is wpscan wrapped to run over a list of URLs instead of one. You hand it a file of WordPress blog URLs and it scans each in turn, fingerprinting core versions, enumerating plugins and themes, and matching findings against the vulnerability database. When you are responsible for a fleet of WordPress sites, or sweeping every WordPress host a recon stage discovered, this is the node that covers all of them in one run.

Everything that makes wpscan useful carries over: configurable enumeration via --enumerate, passive, mixed, or aggressive detection modes, a WPScan API token for vulnerability data, stealthy mode with throttling, and password attacks against discovered users. The difference is the input. A targets file replaces the single --url, so the scanner iterates the whole list and writes a combined result set.

In a Trickest workflow, feed wpscan-loop a file of URLs and collect the folder it writes. Pass in the WordPress hosts a discovery or fingerprinting stage flagged, set JSON output, and route the findings into triage or alerting across the entire set at once.