WPScan

What WPScan does

WPScan is a WordPress security platform that maintains the largest manually curated database of WordPress core, plugin, and theme vulnerabilities, with 74,228 cataloged entries as of 2025. The company's products include the WPScan CLI scanner (a Ruby-based black-box security tool shipped in Kali Linux), a self-serve online scanner at wpscan.com, an official WordPress security plugin, and the WPVulnDB API serving 732,000+ requests per day. WPScan is also a CVE Numbering Authority (CNA) — the third most active globally and the first WordPress-specific — authorizing it to assign CVE identifiers and coordinate responsible disclosure with 30 to 120-day vendor timelines.

The company was founded in 2011 by Ryan Dewhurst as a Ruby script and acquired by Automattic in November 2021, joining Jetpack within Automattic's portfolio (WordPress.com, WooCommerce, WordPress VIP). Enterprise customers such as Kinsta, Accenture, Mercedes-Benz Group, University of North Carolina, Penguin Random House, and WordPress VIP subscribe for API access, custom endpoints, Slack and HTTP webhooks, CVSS risk scoring, and email alerts. The free tier (CLI scanner, online scanner, and 50 requests/day API) plus a €25/month paid API tier (250 requests/day) targets individual site owners, security researchers, and small businesses, while community-sourced vulnerability submissions from hundreds of independent researchers fuel the database.

WPScan operates with a small team (1-10 employees) out of Urrugne, France, governed under California law as a subsidiary of Automattic. Its marketing is predominantly community- and content-led, anchored by a security research blog, an active GitHub repository, and a researcher outreach program that distributes CVE assignments and monthly giveaways. Distribution is multi-channel: enterprise direct sales, self-serve online scanning, WordPress plugin repository, and embedded integrations inside Automattic's Jetpack Protect and WordPress VIP products.

Name

WPScan

Legal name

Automattic Inc.

Website

https://wpscan.com

Company type

Private

Founded year

2011

Operating status

Operating

Headcount range

1–10 employees

Short description

WPScan is a WordPress security platform operating the largest manually curated database of WordPress vulnerabilities (74,228 entries) and a CNA-authorized CVE assignment program, serving enterprise customers, security researchers, and WordPress site owners globally as a subsidiary of Automattic.

Ownership category

akta.pro rank

Product category

WordPress Application Security

NAICS

Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services (518), Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services (5182)

SIC

Services-Prepackaged Software (7372), Services-Computer Processing & Data Preparation (7374)

akta.pro primary industry

Code & Repository Security (Git Security, Code Integrity) (HDADACAG)

akta.pro secondary industry

Application Security & DevSecOps Services (BPAKAHAJ)

Keywords

• WordPress security scanning
• Vulnerability database
• CVE numbering authority
• Penetration testing tools
• Plugin vulnerability detection

Headquarters

HQ city

Urrugne

HQ country

France

HQ region

Europe

Offices1 record

Markets served

GTM type

B2B

Offering type

Software

Cost components

Technology or R&D, Personnel, Infrastructure, Marketing or Sales, Operations

Revenue model

1. Enterprise Subscriptions: Enterprise customers pay custom pricing based on the number of WordPress sites monitored. Services include custom API endpoints, instant email alerts, vulnerability details by ID, webhooks (Slack & HTTP), description and PoC API data, and CVSS Risk Scores. Sold via direct sales with custom quotes.
2. WPVulnDB API - Paid Tiers: Paid API usage costs €25 per month for up to 250 daily requests. Enterprise API usage is available for organizations requiring more than 250 requests per day, priced on a case-by-case basis. Commercial users are required to pay for API access.
3. Free API Access: Non-commercial users receive free API access with a limit of 50 requests per day. The CLI scanner and vulnerability submission form remain free for non-commercial purposes.

Pricing tiers

Go-to-market motion3 records

Distribution channels5 records

Marketing channels8 records

Core offering

WPScan provides a WordPress security platform comprising a CLI scanner (Ruby), an online SaaS scanner, a WordPress plugin, and the WPVulnDB vulnerability database cataloging 74,228+ vulnerabilities in WordPress core, plugins, and themes. The platform identifies security issues, assigns CVE identifiers as a CVE Numbering Authority (CNA), and coordinates responsible vulnerability disclosure with vendors and marketplaces.

Product overview

WPScan is a WordPress security platform consisting of multiple interconnected products: the WPScan CLI Scanner (Ruby-based command-line security scanner), the WPScan WordPress Plugin (in-site security monitoring), the WPScan Online Scanner (SaaS vulnerability scanning service), and the WPVulnDB (comprehensive vulnerability database with 74,228+ entries). The platform is operated as a CVE Numbering Authority (CNA) and offers enterprise plans with API access, Slack/HTTP webhooks, and custom pricing. WPScan was acquired by Automattic in November 2021 and maintains integrations with tools like Dradis Framework for penetration testing workflows.

Differentiator

Problem solved

Functional benefit

Brands

• WPVulnDB: WordPress Vulnerability Database - the vulnerability database API and tracking system used by WPScan CLI and other services
• WPScan CLI
• WPScan WordPress Plugin

Products and services

• WPScan CLI Scanner Black box WordPress security scanner written in Ruby for security professionals, penetration testers, and WordPress site maintainers. Checks WordPress versions, plugins, themes, usernames, weak passwords, exposed backup files, debug logs, and configuration issues against the WPVulnDB.
• WPScan WordPress Plugin WordPress plugin that scans installed WordPress sites for vulnerabilities affecting core, plugins, and themes. Checks for debug.log files, wp-config.php backups, XML-RPC status, code repository files, default secret keys, and exported database files.
• WPScan Online Scanner SaaS-based WordPress vulnerability scanning service that allows users to enter a website URL and receive an instant vulnerability report powered by the WPScan CLI tool and the WPVulnDB database.
• WPVulnDB (WordPress Vulnerability Database) Comprehensive WordPress vulnerability database cataloging 74,228+ vulnerabilities in WordPress core, plugins, and themes. Continuously updated and manually vetted by WordPress security professionals. Available via REST API serving 732,000+ requests per day.
• Enterprise API Plans Custom-priced enterprise API offering including instant email alerts, vulnerability details by ID, latest API endpoints, Slack and HTTP webhooks, description and PoC API data, CVSS Risk Scores, and custom pricing by number of sites monitored.
• Vulnerability Submission Form Submission form for security researchers to disclose WordPress core, plugin, and theme vulnerabilities, with WPScan assigning CVE IDs and coordinating disclosure with vendors under 30-day (extendable to 120-day) timelines.

Quantifiable outcome

• WPScan and two other WordPress security firms account for 23% of all vulnerabilities identified globally in 2025, surpassing MITRE for the first time
• +3 more outcomes

Named customers6 records

Segments3 records

Ideal customer profiles3 records

Technology focussed Yes

API detail

Has API

Yes

API docs

API detail

Core technology

AI maturity

App detail

Integration2 records

Feature6 records

Partnerships

Two partnerships are on record, tiered core.

• WordPress VIPcoreOEM/ Whitelabel/ Licensing Partner · 17 January 2023WordPress VIP, Automattic's managed WordPress hosting platform for enterprise and large-scale websites, has incorporated WPScan into its WordPress VIP Codebase Manager. WPScan's market-leading security technology provides enhanced, proactive protection and threat detection for WordPress VIP enterprise customers, including continuous monitoring of existing plugins and alerts for potential vulnerabilities. WPScan also integrates with WordPress VIP to flag potential vulnerabilities with major sites before they go to production.
• JetpackcoreStrategic or Co-development PartnerWPScan partners with Jetpack (an Automattic product) to power Jetpack Protect, a free WordPress security plugin. Jetpack Protect uses WPScan's vulnerability data to alert users about threats to their websites. This partnership extends WPScan's reach to Jetpack's user base of WordPress site owners.

Scale indicators8 records

Recent moves6 records

Expansion highlights6 records

Broad incumbents

• Qualys: Qualys is a cloud-based security and compliance platform offering vulnerability management, web application scanning, and related services. It competes at the enterprise level for budget allocated to vulnerability management where WPScan is also considered.
• Jetpack: Jetpack is an Automattic-owned WordPress plugin suite that includes security features (Jetpack Protect) powered by WPScan's data. As a same-portfolio product, it is both a partner and a competitive substitute targeting the same WordPress security buyer.
• Sucuri: Sucuri is a website security platform offering malware scanning, firewall, and incident response across multiple CMSes including WordPress. It competes with WPScan for enterprise website security budget and represents a broader, more diversified alternative.
• Tenable: Tenable operates Nessus and a broader vulnerability management platform covering web applications, infrastructure, and cloud. It is a broad incumbent in the vulnerability scanning space that enterprises may choose over specialized WordPress-only tools.
• Snyk: Snyk is a developer security platform that scans open-source dependencies and code for vulnerabilities. While focused on open-source code rather than live CMS applications, it competes for the same DevSecOps tooling budget that uses WPScan's API.

Direct peers

• Patchstack: Patchstack is the most direct competitor to WPScan, operating a WordPress vulnerability database, coordinated disclosure program, and CNA status. Both companies compete head-to-head for enterprise vulnerability intelligence customers managing WordPress estates.
• Wordfence: Wordfence is a WordPress security plugin offering vulnerability scanning, firewall, and malware detection. It is one of the three firms (alongside WPScan and Patchstack) accounting for 23% of CVEs identified globally, and competes directly for WordPress site owner security budgets.

Others

• MITRE Corporation: MITRE operates the CVE program and maintains CWE classifications. WPScan is a CNA under MITRE's CVE program. They are adjacent ecosystem players in the global vulnerability disclosure infrastructure rather than direct commercial competitors.
• HackerOne: HackerOne operates a vulnerability disclosure and bug bounty platform that coordinates between researchers and vendors. WPScan plays a similar coordinator role for WordPress vulnerabilities and competes for the same security researcher community mindshare.

Emerging players

• Detectify: Detectify is an automated web application vulnerability scanner serving security teams. While broader than WordPress-only, it overlaps with WPScan's API-based vulnerability intelligence use case and competes for developer-focused security budgets.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat6 records

Key risks5 records

Key highlights7 records

Customer concentration

• Xx.com/_wpscan_
• GitHubgithub.com/wpscanteam/wpscan
• Facebookfacebook.com/WPScan

Revenue estimate

Valuation estimate

Number of profiles

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about WPScan