Plecost

Plecost finds vulnerabilities in WordPress installations: core, plugins and themes. Every finding is matched against a local CVE database that updates daily.

It lives in its own GitHub organization, but it’s mine. I started it in 2014 and rewrote it from scratch for version 4.

Why it exists

Anyone auditing WordPress in production hits the same wall: API rate caps, vulnerability data that depends on an external service, no way to use it as a library, and slow scans because nothing runs concurrently.

Plecost fixes exactly that. No Ruby, no API key, no subscription. No data leaves to third parties on every scan.

What it does

• Async scanning with configurable concurrency
• Runs as a CLI, as a Python library, or inside a task queue like Celery
• Fast mode (top 150 plugins and 50 themes) and deep mode (4,750+ plugins and 900+ themes)
• Dedicated modules for WooCommerce and WP eCommerce
• Authenticated scans, HTTP and SOCKS5 proxies, stealth mode and bulk scanning from a file
• Output built for automation

+380 stars on GitHub and used in production.