skills.rest
EntroVyx
EntroVyxCOMMUNITY
Explore all skills by this author →
GitHub

wordpress-plugin-hunt

Identify WordPress plugins and versions via REST API, readme.txt, and HTML fingerprinting.

3|1|Updated Jul 2, 2026
Search Tags:#reconnaissance#exploitation#web-security#pentesting#wordpress#cve
One-click install
npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill wordpress-plugin-hunt-entrovyx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: wordpress-plugin-hunt
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/recon/wordpress-plugin-hunt
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill wordpress-plugin-hunt-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires curl, nmap, python3, masscan, subfinder, httpx, nuclei.

What problem does it solve?

This skill automates the discovery of WordPress plugin versions and cross-references them against known vulnerabilities, allowing security researchers to identify exploitable attack surfaces efficiently.

Core Features & Use Cases

  • Multi-Method Detection: Probes REST API namespaces, reads readme.txt files, and analyzes HTML source code to fingerprint plugins.
  • Vulnerability Mapping: Automatically flags outdated plugins with known CVEs such as RCE, SQLi, and privilege escalation.
  • Use Case: During a penetration test, use this skill to quickly map the plugin landscape of a WordPress target and identify high-impact entry points like Slider Revolution or Elementor vulnerabilities.

Quick Start

Use the wordpress-plugin-hunt skill to scan example.com for vulnerable plugins and report any discovered CVEs.

Frequently Asked Questions about wordpress-plugin-hunt

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find vulnerable WordPress plugins during a pentest?▼

To find vulnerable WordPress plugins during a pentest, probe the REST API namespaces, analyze readme.txt files, and fingerprint HTML source code to identify plugin versions and map them against known CVEs.

What methods detect WordPress plugin versions for bug bounty reconnaissance?▼

Detecting WordPress plugin versions for bug bounty reconnaissance involves probing REST API namespaces, analyzing readme.txt files, and fingerprinting HTML source code to pinpoint installed plugins and flag known vulnerabilities.

Do I need nuclei and masscan to scan for WordPress CVEs?▼

Yes, you need nuclei and masscan along with curl, nmap, python3, subfinder, and httpx to perform comprehensive environment scanning and verify known WordPress plugin vulnerabilities.

Can I identify RCE vulnerabilities in WordPress plugins automatically?▼

You can identify RCE vulnerabilities in WordPress plugins automatically by fingerprinting plugin versions through REST API probing and readme.txt analysis, then cross-referencing those versions against known CVE databases.

What is the best way to map a WordPress target's attack surface?▼

The best way to map a WordPress target's attack surface is to automate multi-method plugin detection using REST API probing, readme.txt analysis, and HTML fingerprinting to flag outdated plugins with known CVEs.

Are there limitations to detecting WordPress plugins via REST API probing?▼

Limitations of detecting WordPress plugins via REST API probing include failing when APIs are disabled or blocked, requiring fallback methods like HTML source code fingerprinting and readme.txt analysis for accurate version identification.

Related Skills

Explore More Software Engineering Skills→
EntroVyxEntroVyx
3

cors-credential-wordpress

Detect and validate CORS credential reflection vulnerabilities in WordPress REST API endpoints.

Community
Advanced
uphiagouphiago
1.1k

wordpress-plugin-hunt

Detect installed WordPress plugins and cross-reference versions against known CVEs.

Community
Intermediate
guib1guib1
1

web2-recon

Automate web2 reconnaissance by chaining subdomain enumeration, live-host discovery, and URL crawling.

Community
Advanced
dgethingsdgethings

nmap-service-detection

Identify services and OS details on open ports with nmap.

Community
Advanced