Vulnytics is a security console for WordPress. It matches every plugin, theme and core file against a live CVE database, scores your risk, blocks known exploits at runtime, and proves what it caught.
Not a wall of alarms — a security instrument that shows the CVE, the CVSS, and the exact version that fixes it.
Every installed component is matched, version-range by version-range, against a live database of known CVEs. You get findings ranked by CVSS, a 0–100 security score and an A–F grade — the whole picture at a glance.
Open any finding and you get the CVE, the CVSS vector, the affected range, references, and the version that patches it — then update with a click. No guesswork, no copy-paste from a dozen tabs.
When a known exploit hits a component you haven't updated yet, Vulnytics blocks the request at runtime — closing the dangerous gap between a CVE going public and a vendor fix. Run it in monitor or enforce mode.
Core files verified against WordPress.org checksums; theme, plugins, uploads and your database scanned for injected code. Quarantine a suspicious file in one click.
File editing, XML-RPC, user enumeration, salts, headers and more — audited, with one-click fixes on Pro.
Every client site's score in one place, plus a clean white-label PDF report — your logo, your name. The deliverable clients actually read.
Generate a self-contained, printable security report — branded with your agency's name and logo — covering the score, findings, hardening and file integrity. The kind of deliverable that justifies a retainer.
Add Vulnytics to any WordPress site from your dashboard. No account needed to start — the free tier scans immediately.
Components are matched against the live CVE database server-side. You get findings, a security score, a 13-point hardening audit and a malware check.
Update with a click, harden in one tap, turn on virtual patching and 2FA, and hand your client a branded report.
Billed securely through Paddle. 14-day money-back guarantee — cancel anytime.
17,795 CVE records across WordPress core, plugins and themes — aggregated from WPVulnerability, NVD and Wordfence Intelligence, refreshed daily. Matching runs on our servers, so the data can't be extracted from the plugin.
Only the type, slug and version of your installed components. No content, URLs, credentials or file contents — ever. See our Privacy Policy.
No. The heavy matching happens server-side; the plugin sends a tiny inventory. Hardening, integrity and protection run locally and are bounded for performance.
It's targeted, per-vulnerability mitigation: when a known exploit pattern hits a flagged component, the request is blocked. A focused wedge — and we're honest that it isn't a generic WAF.
Anytime, from your billing dashboard, with a 14-day money-back guarantee. See our Refund Policy.
Install the free plugin and run your first scan in under a minute.
Vulnytics