WordPress plugin vulnerability checker

Your plugin list

Check for known vulnerabilities Clear

How to get your plugin list

The most exact source is WP-CLI, from the site's directory:

wp plugin list

Paste the whole table — borders and all — and the checker reads the name and version columns. Without shell access, the plugin names in your wp-content/plugins/ directory are the slugs this tool expects (the folder name, like contact-form-7, not the display name), and each plugin's version is shown on the Plugins screen in wp-admin. Versions are optional but matter: with a version the checker can say whether your installed release is affected, not just whether the plugin has ever had a vulnerability.

What a result means

A flagged plugin has a publicly documented vulnerability affecting the version you pasted. That is a prediction about risk, not evidence of compromise — but it is the single most common way WordPress sites actually get hacked, because disclosed vulnerabilities are scanned for at internet scale within days. The fix is almost always the same: update to the patched version the result names. If the entry says no fix is available, deactivate the plugin until one ships, or shield it behind a firewall rule in the meantime.

A clean result means none of the pasted plugins has a known vulnerability in that version. It is one layer: it says nothing about malware already on the site, modified files, weak passwords or abandoned-but-unflagged code. Those need a scanner running on the site itself — which is what Wordfence does, and what the glossary entry for its vulnerability findings explains how to read.

Common questions

Where does the vulnerability data come from?

From the Wordfence Intelligence vulnerability database, published by Defiant Inc. (the makers of Wordfence) and updated continuously by their research team. This checker queries a copy refreshed several times a day, so a brand-new disclosure can take a few hours to appear here.

My plugin was flagged — does that mean my site is hacked?

No. A known vulnerability means the version you run has a publicly documented weakness, not that anyone has used it against you. It does mean updating is urgent: disclosed vulnerabilities are exactly what attackers scan the whole internet for. Update to the patched version, and if no patch exists, deactivate the plugin until one does.

Nothing was found — is my site safe?

It means none of the plugins you pasted has a publicly known vulnerability in that version, which is one important signal and not a security audit. It says nothing about your themes, WordPress core, weak passwords, or malware already present. A scanner such as Wordfence running on the site covers those.

What happens to the plugin list I paste?

The paste is parsed in your browser; only plugin slugs and version numbers are sent to this site's server, compared against the vulnerability index in memory, and the result returned. Nothing is written to disk, logged with your address, or used for anything beyond answering the request.

Related reading

• "Plugin has a security vulnerability" — the Wordfence finding explained Glossary
• "Plugin needs an upgrade" — why outdated is a security state Glossary
• A triage workflow for Wordfence alerts Guide
• Wordfence vs Jetpack Protect — comparing the two vulnerability databases Comparison
• Wordfence alert explainer Free tool

Vulnerability data: Wordfence Intelligence, © Defiant Inc., accessed via their free vulnerability API. This site is not affiliated with Defiant.