Every plugin, theme and core file on your CMS, checked and reported.
vScan scans every plugin, theme, core file and server component on your WordPress, Joomla or Drupal site, then checks each one against known CVEs.
From plugin to PHP, nothing left out.
Every component on your CMS gets checked: plugins, themes, WordPress core, PHP runtime, the web server itself. Each one logged with its version and any known vulnerabilities.
- Type-aware inventory Plugin · Theme · Core · Server · Runtime
- Filter chips, not dropdowns Vulnerable · Safe · By type · Search by CVE
Every new CVE checked against your site. Hourly on Premium, daily on Free.
vScan pulls from public CVE feeds and our own database. When a new vulnerability is published for something on your site, it gets flagged on your next scan. Every hour on Premium, every 24 hours on Free.
- Hourly scanning · Premium Your site re-fingerprinted every 60 minutes
- Daily scanning · Free Full inventory re-scan once every 24 hours
- Severity prioritization Real exploitability ranks first, not just CVSS
- Impact-scored alerts Only flagged if the vulnerable component is active on your site
The whole toolkit
Built for the job, not the demo.
The features that work in the background so your team can focus on building.
Scheduled scanning
Every component re-checked on your next scan automatically. No manual trigger needed. Premium runs every hour, Free runs every 24 hours.
Full-stack inventory
Plugins, themes, CMS core, PHP runtime, web server. Every layer checked and logged with its exact version.
Severity prioritization
Findings ranked by how likely they are to be exploited, not just the highest CVSS score.
Smart filtering & search
Filter by status and type with live counts. Search by software name, version or CVE ID.
Alerts routing Coming soon
Email, Slack and webhooks send an alert when we find a vulnerable component on your site.
CSV export Coming soon
Pull the whole inventory or just the vulnerable rows. For audits, compliance, or piping into your own tools.
Multi-CMS coverage
Three CMSes, one console.
Whatever flavour of CMS your team ships on, vScan speaks it. Same dashboard, same inventory model, same CVE feed - just pointed at a different stack.
Privacy & control
No access to your server. No changes to your files.
No agents installed on your server. No write access to your database or files. vScan only reads what is installed and reports back.
Bound to one domain.
Every API key locks to a single domain on first save. If someone exfiltrates it, it can't be used anywhere else.
Installed in your CMS. Not on your server.
vScan runs as a lightweight plugin inside your WordPress, Joomla or Drupal. No SSH credentials, no server daemon, no kernel access - just a plugin that reads your installed components and reports back.
We look. We don't touch.
vScan never writes to your database, never edits a file, never auto-runs an update. The plugin reads what's installed and reports back - your hand stays on every fix.
