How to Check WordPress Plugins for Vulnerabilities (Free)

Key takeaways

In 2025, 11,334 new WordPress vulnerabilities were reported, 91% of them in plugins.
46% had no fix when they were made public, so updating alone is not always enough.
For heavily targeted flaws, the weighted median time to the first attack was 5 hours.
Inactive plugins are a risk too. WordPress itself recommends deleting them.
Only install plugins from official sources, never pirated "nulled" copies.

Why plugins are the weak spot

WordPress core is rarely the problem. Of the 11,334 vulnerabilities reported in 2025, only six were in core, all of them low priority. 91% were in plugins and 9% in themes (Patchstack, State of WordPress Security in 2026). Every plugin is code from a different developer with a different update rhythm. And attacks come fast: for the most targeted flaws, the weighted median time to the first exploit was five hours, and about half of the high-impact vulnerabilities were exploited within 24 hours. Why this keeps getting worse is covered in our overview of WordPress security flaws.

Step 1: list your plugins and versions

In WordPress, go to Plugins, Installed Plugins. You see every plugin, whether it is active and its version. A compact list is under Tools, Site Health, the Info tab, sections "Active Plugins" and "Inactive Plugins". It also shows the author and whether auto-updates are on (Site Health docs).

Step 2: compare with a vulnerability database

These databases are free to search by plugin name:

Database	What you get for free
Patchstack Database	Open vulnerability database with search across plugins, themes and core
Wordfence Intelligence	Free vulnerability database from the makers of Wordfence, searchable in the browser
WPScan	Browsable list of plugin vulnerabilities. The free API allows 25 requests a day for non-commercial use

The US National Vulnerability Database (NVD) is less useful here. Since April 2026 it only adds severity scores to priority vulnerabilities, so most plugin entries stay unscored (NIST).

Step 3: let a plugin check automatically

Checking by hand works once. For ongoing protection, a scanner plugin compares your plugins with a database every day. What the free versions include, according to their WordPress.org pages:

Plugin	Free version	Paid extras
Wordfence	Checks for known vulnerabilities, warns about closed or abandoned plugins	Firewall rules and malware signatures in real time (free: 30 days delayed)
Patchstack	Finds vulnerabilities in plugins, themes and core, overview for up to 3 sites, email alerts	Virtual patching, 5 dollars per site a month
Jetpack Protect	Daily scan of WordPress, plugins and themes, using WPScan data	Malware scan, instant alerts, firewall
Solid Security Basic	Scans for known vulnerabilities four times a day	Automatic patching

One scanner is enough, since it is a plugin too. Skip the stand-alone WPScan plugin: it is no longer actively supported for non-enterprise customers and points to Jetpack Protect instead (WPScan plugin page).

Step 4: watch for two warnings on WordPress.org

Open each plugin's page in the WordPress.org directory. Two notices should make you act (WordPress.org plugin handbook):

"This plugin has been closed", often with a reason. One official reason is "Security Issue". A closed plugin gets no updates through WordPress.org, so replace it.
"This plugin hasn't been tested with the latest 3 major releases of WordPress." WordPress.org adds that it may no longer be maintained. Look for an actively maintained alternative.

Step 5: clean up and automate updates

Delete what you don't use. Deactivating is not enough, the code stays on the server. WordPress's Site Health check warns that inactive plugins are tempting targets for attackers, and the official hardening guide says to delete plugins you don't use (hardening guide).
Turn on auto-updates. Since WordPress 5.5 you can switch them on plugin by plugin in the "Automatic updates" column on the Plugins screen. WordPress checks twice a day and emails you about the result (WordPress.org).
Replace abandoned plugins before they become a problem, not after.
No pirated plugins. A Georgia Tech study of 410,122 WordPress sites found 47,337 malicious plugin installations on 24,931 sites. 8,525 of them were "nulled", meaning cracked copies of paid plugins (USENIX ;login:).

What to do when a plugin has a known vulnerability

A fix exists: update right away, not at the next maintenance window.
No fix yet: deactivate and delete the plugin and look for an alternative. Firewall services such as Patchstack or Wordfence can block known attacks in the meantime ("virtual patching").
Signs it was already used: follow what to do when your WordPress site was hacked.

Cleaning up also pays off before your next PHP upgrade, because older plugins are often not ready for new PHP versions. More in how to check and update your PHP version.

Or: fewer plugins to check

The safest plugin is the one you don't need. On ShiftPress, things that usually take a plugin each in WordPress, such as forms, cookie consent, SEO basics and translations, are part of the platform, and every page is delivered as finished HTML through Cloudflare. There is no plugin list to check. More in why WordPress feels like work.

Frequently asked questions

How often should I check my plugins?

With a scanner plugin, the check runs every day or more often. Without one, check at least once a month, and whenever a major WordPress vulnerability is in the news.

Is turning on auto-updates enough?

It helps a lot, but not completely. 46% of the vulnerabilities reported in 2025 had no fix when they were made public, and closed plugins get no updates at all. You still need to know which plugins are affected.

Are deactivated plugins dangerous?

They can be. Deactivating leaves the code on the server. WordPress's own Site Health check warns that inactive plugins are tempting targets for attackers and recommends removing them.

Which security plugin is the best?

There is no single best one. Wordfence, Patchstack, Jetpack Protect and Solid Security all check for known vulnerabilities in their free versions. Pick one that fits, and don't install several at once.

Are premium plugins safer than free ones?

Not automatically. In Patchstack's 2026 report, premium components made up 29% of all vulnerability reports, and 76% of those were exploitable in real attacks.

What is a nulled plugin?

A pirated copy of a paid plugin, offered for free. A Georgia Tech study of 410,122 WordPress sites found 8,525 nulled plugins among 47,337 malicious plugin installations. Only install plugins from WordPress.org or the developer.

The bottom line

Plugins are where WordPress gets hacked. Know what you have installed, let a scanner compare it with a vulnerability database every day, delete what you don't use and replace what nobody maintains any more. The fewer plugins you run, the less there is to watch.

Sources: Patchstack, WordPress.org plugin handbook, WordPress.org auto-updates, WordPress hardening guide, NIST, USENIX ;login:.

How to check your WordPress plugins for vulnerabilities, for free