WordPress Vulnerability Scanner
Free WordPress vulnerability scanner for the GCC. Detect known CVEs, plugin and theme risks, and common misconfigurations, then verify ownership and get a full report.
The WordPress Vulnerability Scanner is a free tool from Louis Innovations for businesses across the GCC. Enter your site URL and the scanner detects the WordPress core version, installed plugins, and themes, then checks them against a curated database of more than 80 known vulnerabilities published through 05 Nov 2026.
It also flags common misconfigurations such as exposed wp-config.php backups, reachable debug.log, open xmlrpc.php, user enumeration, directory listing, missing HTTPS, and outdated PHP. A future-risk watchlist names every detected component that should be monitored for newly disclosed CVEs.
Full results are released only after two ownership checks pass: an email code sent to an address on the scanned site's domain, and a Firebase SMS code to a GCC mobile number. This keeps the tool in the hands of real site owners. The same Louis Innovations cybersecurity team can then fix whatever the scan finds.
Features
CVE detection for WordPress core
Checks the detected WordPress core version against known CVEs published through 05 Nov 2026, with affected and fixed version ranges.
Plugin and theme risk matching
Extracts plugin and theme slugs from the public page and matches them against a curated vulnerability database covering Elementor, WooCommerce, Contact Form 7, WPForms, and more.
Misconfiguration checks
Tests for exposed wp-config.php backups, reachable debug.log, open xmlrpc.php, user enumeration, directory listing, missing HTTPS, outdated PHP, default admin username, and reachable install.php.
Future-risk watchlist
Lists every detected component with advice to keep it updated and remove unused ones, so you can monitor for newly disclosed CVEs.
Ownership verification
Releases full results only after a domain email OTP and a Firebase SMS OTP to a GCC mobile number both pass. No bypass.
Search tracking and saved history
Logs every search with IP address, user agent, URL, domain, and result. Verified users can reopen saved reports for domains they own.
Who it is for
- Businesses in Qatar, the UAE, Saudi Arabia, Kuwait, Oman, and Bahrain running WordPress websites
- Website owners who want a free vulnerability report before commissioning security work
- Marketing and IT teams checking plugin and theme risk after updates
For Qatar and the GCC
The scanner is built for the GCC. Verification requires a GCC mobile number from Qatar, the UAE, Saudi Arabia, Kuwait, Oman, or Bahrain, and email ownership on the scanned site's own domain. Louis Innovations is based in Doha and provides cybersecurity services across all six GCC countries, in Arabic and English.
Frequently asked questions
Is the WordPress vulnerability scanner free?
Yes. Anyone can run a scan and, after verifying ownership, view the full report at no cost. You pay only if you hire Louis Innovations for remediation.
How does ownership verification work?
You request a one-time code to an email address on the scanned site's domain, then verify a GCC mobile number through a Firebase SMS code. Both must pass before full results are shown.
Does the scan modify my website?
No. The scanner only reads public pages and checks HTTP responses. It never logs in, writes data, or attempts exploitation.
What vulnerabilities does it check?
It checks WordPress core, popular plugins, and themes against a curated database of more than 80 CVEs published through 05 Nov 2026, plus common misconfigurations.
Can I reopen a saved report later?
Yes. Verified users can view saved reports for domains they have verified, from the My reports section of the scanner.