Find vulnerabilities.
Without adding one.
WPGrip scans your plugins, themes, and WordPress core against a known vulnerability database. It runs over SSH using WP-CLI — no security plugin installed on your site, no extra attack surface.
See what's vulnerable across every site
WPGrip checks the exact version of every plugin, theme, and WordPress core installation against the WPScan vulnerability database. You get a clear list of what's affected, the severity, and which version fixes it.
- Scans plugins, themes, and WordPress core versions
- Matches against the WPScan vulnerability database
- Shows severity level for each vulnerability
- Tells you which version contains the fix
- Flags vulnerabilities across your entire portfolio
SSH in. Read versions. Check the database.
WPGrip connects to your server over SSH and uses WP-CLI to list every installed plugin, theme, and the WordPress core version. It then checks each version against the WPScan vulnerability database. No code runs on your WordPress site. No plugin is installed. Nothing is exposed to the web.
Inventory via WP-CLI
WPGrip runs wp plugin list and wp theme list over SSH to get the exact name and version of everything installed on your site.
Match against the database
Each plugin, theme, and core version is checked against the WPScan vulnerability database — a continuously updated catalog of known WordPress security issues.
Report and alert
If a vulnerability is found, you see it in your dashboard with the severity, description, and the version that fixes it. Alerts go to your configured channels.
Backed by the WPScan database
The WPScan vulnerability database is the most comprehensive catalog of WordPress security issues. It covers tens of thousands of plugins, themes, and WordPress core versions. WPGrip checks your sites against this database so you know about vulnerabilities as they're disclosed.
- Covers plugins, themes, and WordPress core
- Updated daily with newly disclosed vulnerabilities
- Includes severity ratings and fix versions
- Tracks the most widely used WordPress ecosystem
- Trusted by security teams and hosting providers
Every plugin. Every theme. Every version.
WPGrip doesn't just check active plugins. It checks everything installed on your site — active or inactive. An inactive plugin with a vulnerability is still a risk if the files are on the server.
- Active and inactive plugins
- Active and inactive themes
- WordPress core version
- Exact version matching — not guesswork
- Cross-referenced against known CVEs
- Severity classification: High, Medium, Low
- Installs PHP code on your WordPress site
- Adds REST API endpoints that attackers can probe
- Stores configuration in your database
- Runs on every page load — adds latency
- Requires WordPress admin credentials
- Is itself a potential attack vector
- Zero code installed on your WordPress site
- No REST API endpoints exposed
- Nothing stored in your WordPress database
- Zero impact on page load performance
- Uses SSH key authentication — no WP credentials
- Cannot be exploited from the web
The irony of security plugins
Most WordPress security plugins are themselves an attack surface. They install PHP files, create REST API endpoints, store data in your database, and run code on every page load. If the security plugin has a vulnerability — and they do — your site is exposed.
WPGrip takes a different approach. Your vulnerability scan runs over SSH, outside of WordPress. Nothing is installed. Nothing is exposed to the web. Nothing runs when your visitors load a page. The scan reads version numbers, checks a database, and reports back. That's it.
One vulnerable plugin, ten affected sites
When a popular plugin discloses a vulnerability, you need to know which of your sites are affected. WPGrip gives you a portfolio-wide view — see every site running the vulnerable version, and update them all from one place.
- Portfolio-wide vulnerability dashboard
- See which sites are affected by a specific CVE
- Update vulnerable plugins across all sites at once
- Track your fix progress as you patch each site
- Alerts when new vulnerabilities affect your portfolio
Protect your sites without adding to the problem
Free trial. No credit card. No plugins to install.