Title: VulnCue
Author: vulncue
Published: September 18, 2026
Last modified: September 18, 2026
---
Search plugins
# VulnCue
By [vulncue](https://profiles.wordpress.org/vulncue/)
[Download](https://downloads.wordpress.org/plugin/vulncue.1.0.0.zip)
* [Details](https://wordpress.org/plugins/vulncue/#description)
* [Reviews](https://wordpress.org/plugins/vulncue/#reviews)
* [Installation](https://wordpress.org/plugins/vulncue/#installation)
* [Development](https://wordpress.org/plugins/vulncue/#developers)
[Support](https://wordpress.org/support/plugin/vulncue/)
## Description
VulnCue scans your WordPress **from the inside**, something an external
scanner
can’t do with the same precision: an exact inventory of installed plugins and themes,
outdated core, an unsupported PHP version, uncustomized wp-config.php security keys,
an active file editor, an exposed “admin” user, active XML-RPC, sensitive files
left in the public folder (backups, `.env`, .git), and more.
All of these checks are **100% free, with no need to create an account or
give
your email
. If you want an email alert when a new vulnerability (CVE)
affects
one of your installed plugins, you can connect a free account from VulnCue’s client
area (https://vulncue.com/) — optional, never required to use the plugin.
### External services
By default, this plugin **sends no data to external servers**. All checks
use WordPress’s
own data (update transients, wp-config.php constants, the public folder’s file listing).
Six exceptions, all of which can be turned off or only trigger on your
explicit
action (the first three from the plugin’s screen; the fourth and fifth only activate
if you connect an account yourself; the sixth only if you choose to send it):
* **Checks that make the site send a request to itself**: XML-RPC
(`xmlrpc.php`),
user enumeration via the REST API (`/wp-json/wp/v2/users`), SSL/TLS certificate
expiry and trust (two HTTPS connections to the site’s own domain), directory
listing on `wp-content/uploads/`, and whether the homepage reveals the WordPress
version in the `` tag. None of these requests go out to
VulnCue or any third party — it’s your own WordPress talking to itself to check
how it responds. The whole group can be disabled with the “Include checks that
make this site send a request to itself” checkbox.
* **Known vulnerability check (enabled by default, no account or email
needed)
:
the plugin sends vulncue.com the list of installed plugins and
themes (only
the technical name and version, never personal data or anything about your site)
to check them against VulnCue’s public CVE catalog. Can be disabled with the “
Check installed plugins/themes against VulnCue’s public vulnerability catalog”
checkbox.
* **Core integrity verification (enabled by default, no account or email
needed)
:
the plugin queries `api.wordpress.org` (WordPress’s own official
server, not
VulnCue’s) to get the public checksums for your WordPress version and check that
the core files haven’t been modified. Only the WordPress version and language
are sent, never anything about your site. Can be disabled with the “Check WordPress
core integrity” checkbox.
* **Account connection (optional, the only one that sends your email)**: if
you
choose to enter your email to connect a free account, the plugin sends your site’s
URL, your email, and your WordPress version to vulncue.com, to create your account
and be able to email you about new CVEs. Privacy policy: https://vulncue.com/
politica-privacidad.html
* **Scheduled auto-scan + inventory report (only if you connected an
account)
:
every hour, WP-Cron checks (sending only your connection key)
whether a new
automatic scan is due — every 7 days on the free plan, every day on a paid plan;
the hourly check only shortens the wait for the first scan after connecting,
it doesn’t increase the actual frequency. When it’s due, besides scanning your
site it sends the list of installed plugins and themes (technical name and version,
never personal data) so it can email you if any of them has a new vulnerability—
each alert is sent only once per vulnerability. Also, once your account is connected,
you’ll get a weekly email with your current risk level and findings (this summary
is sent by your own WordPress, not by vulncue.com). If you haven’t connected
an account, none of this happens and scanning stays fully manual (“Scan again”).
* **Deactivation survey (optional)**: when you deactivate the plugin you can
say
why. Choosing “Skip” sends nothing. Writing something and confirming sends vulncue.
com the site’s URL, the reason, and the WordPress/PHP/plugin versions — never
your email or any other personal data.
## Screenshots
[⌊Main screen: 0-100 risk level and findings grouped by severity.⌉⌊Main screen:
0-100 risk level and findings grouped by severity.⌉[
Main screen: 0-100 risk level and findings grouped by severity.
[⌊Finding detail, with the fix explained step by step.⌉⌊Finding detail, with the
fix explained step by step.⌉[
Finding detail, with the fix explained step by step.
[⌊VulnCue account connection (optional) to get email alerts for new vulnerabilities.⌉⌊
VulnCue account connection (optional) to get email alerts for new vulnerabilities
.⌉[
VulnCue account connection (optional) to get email alerts for new vulnerabilities.
[⌊Summary widget on the WordPress Dashboard.⌉⌊Summary widget on the WordPress Dashboard
.⌉[
Summary widget on the WordPress Dashboard.
[⌊Help page: what information leaves your site and when, plus the free vs. paid-
plan comparison.⌉⌊Help page: what information leaves your site and when, plus the
free vs. paid-plan comparison.⌉[
Help page: what information leaves your site and when, plus the free vs. paid-plan
comparison.
## Installation
1. Upload the `vulncue-security` folder to `/wp-content/plugins/`, or install it from
Dashboard Plugins Add New, searching for “VulnCue”.
2. Activate it.
3. Go to “VulnCue” in the side menu to see the result of the first scan (it runs automatically
on activation).
## FAQ
### Does this replace a full security audit?
No. This plugin only sees what’s visible **from inside** your WordPress
installation.
An external scan (like the one VulnCue runs from the outside, or a pentest) checks
additional things that can only be seen from the outside: TLS certificate, HTTP
headers, email SPF/DMARC records, mixed content, etc.
### Do I have to create an account to use it?
No. Scanning and the known-vulnerability check work without creating any
account.
The account is optional and only adds email alerts for new CVEs.
### Does the plugin fix issues automatically?
No. By design, it doesn’t modify anything on your site — it only detects
issues
and explains how to fix each one. Applying the change (updating, moving a file,
editing wp-config.php) is up to you or whoever manages the site.
### Does it slow down my site?
No. The whole scan only runs when you open the plugin’s screen in wp-admin —
never
for your visitors or on the public side of your site.
### How is the 0-100 risk level calculated?
It starts at 0 and each finding adds points based on its severity: up to 30
for
critical, 18 for high, 8 for medium, 3 for low, and 1 for informational — each additional
finding of the same severity adds less and less, so lots of minor warnings don’t
drive up the risk as much as a single serious one. 0 means no problem was detected
in the last scan, and 100 is the maximum risk.
### How often should I scan my site again?
You can click “Scan again” whenever you want. If you connect an account, it
also
scans itself automatically: every 7 days on the free account, every day on a paid
plan.
### Does it work on WordPress Multisite installs?
Yes. Each site on the network is scanned separately (its own findings and
risk
level), and the Network Dashboard shows a combined summary of every site.
### What happens if I uninstall the plugin?
Everything the plugin saved on your WordPress is deleted, and the client area
is
notified that this site is no longer connected. Your VulnCue account itself isn’t
deleted (in case you use it on another site with the same email).
## Reviews
There are no reviews for this plugin.
## Contributors & Developers
“VulnCue” is open source software. The following people have contributed to this
plugin.
Contributors
* [ vulncue ](https://profiles.wordpress.org/vulncue/)
[Translate “VulnCue” into your language.](https://translate.wordpress.org/projects/wp-plugins/vulncue)
### Interested in development?
[Browse the code](https://plugins.trac.wordpress.org/browser/vulncue/), check out
the [SVN repository](https://plugins.svn.wordpress.org/vulncue/), or subscribe to
the [development log](https://plugins.trac.wordpress.org/log/vulncue/) by [RSS](https://plugins.trac.wordpress.org/log/vulncue/?limit=100&mode=stop_on_copy&format=rss).
## Changelog
#### 1.0.0
* First public release. 100% local, free-forever check engine, no account or
email
needed: outdated core/plugins/themes, PHP EOL, WP_DEBUG, default security keys,
DISALLOW_FILE_EDIT, exposed “admin” user, open registration with administrator
as the default role, exposed sensitive files, exposed readme.html and generator
tag, PHP execution and directory listing in the uploads folder, table prefix
and wp-config.php permissions, inactive plugins/themes, automatic core updates,
two-factor authentication, brute-force protection, backup plugin, new or recently
promoted administrator accounts, XML-RPC, REST user enumeration, and SSL/TLS
certificate expiry/trust.
* Known vulnerability (CVE) check against VulnCue’s public catalog and core
integrity
check against wordpress.org’s official checksums — both enabled by default, no
account or email needed, and both can be disabled.
* Optional connection of a free VulnCue account (email only, with
link-based confirmation)
for new-CVE email alerts and a weekly risk-level summary — never required for
the rest of the plugin. Scheduled auto-scan via WP-Cron for connected accounts.
* 0-100 risk level with a visual ring (0 = no issues found, the higher it
is,
the more important the findings; repeated findings of the same severity weigh
less each time so the scale doesn’t saturate), a severity bar, and a history
chart of the risk level with each scan’s number always visible.
* Hide individual findings you’re already aware of (with its own list so
you can
unhide them whenever you want) — they don’t count toward the risk level or the
menu badge while hidden.
* Menu-bar alert for new critical/high findings, a reminder if it’s been a
while
since your last scan, a “what’s changed since your last scan” summary, Tools
Site Health integration, PDF export, and WordPress Multisite support (a summary
of every site on the network, from the Network Dashboard).
* Full English translation (en_US, en_GB, en_AU, en_CA, en_NZ, en_ZA): the
whole
plugin also works on English-language WordPress installs.
* Optional “why are you deactivating VulnCue?” survey when clicking
“Deactivate”
on Dashboard Plugins, with the option to skip it and just deactivate.
* WP-Cron check every hour (previously once a day) so the first automatic
scan/
report after connecting an account takes at most ~1 h instead of up to 24 h —
the real scan frequency (7 days free, 1 day paid) doesn’t change, only the first-
time worst case.
## Meta
* Version **1.0.0**
* Last updated **2 days ago**
* Active installations **Fewer than 10**
* WordPress version ** 6.0 or higher **
* Tested up to **7.1.1**
* PHP version ** 7.4 or higher **
* Tags
* [audit](https://wordpress.org/plugins/tags/audit/)[hardening](https://wordpress.org/plugins/tags/hardening/)
[scanner](https://wordpress.org/plugins/tags/scanner/)[security](https://wordpress.org/plugins/tags/security/)
[vulnerability](https://wordpress.org/plugins/tags/vulnerability/)
* [Advanced View](https://wordpress.org/plugins/vulncue/advanced/)
## Ratings
No reviews have been submitted yet.
[Your review](https://wordpress.org/support/plugin/vulncue/reviews/#new-post)
[See all reviews](https://wordpress.org/support/plugin/vulncue/reviews/)
## Contributors
* [ vulncue ](https://profiles.wordpress.org/vulncue/)
## Support
Got something to say? Need help?
[View support forum](https://wordpress.org/support/plugin/vulncue/)