skills.rest
EntroVyx
EntroVyxCOMMUNITY
Explore all skills by this author →
GitHub

wp-plugin-automation

Detect WordPress plugin versions and match them against CVE databases.

3|1|Updated Jul 2, 2026
Search Tags:#automation#vulnerability#reconnaissance#wordpress#cve#pentest
One-click install
npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill wp-plugin-automation-entrovyx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: wp-plugin-automation
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/redteam/wp-plugin-automation
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill wp-plugin-automation-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires curl, jq, python3.

What problem does it solve?

This skill solves the manual bottleneck of identifying and verifying high-impact CVEs across large fleets of WordPress domains, allowing security researchers to focus on exploitation rather than reconnaissance.

Core Features & Use Cases

  • Automated Plugin Detection: Scans target lists to identify specific plugin versions via readme.txt and REST API endpoints.
  • CVE Matching Matrix: Automatically correlates detected plugin versions against a curated list of high-impact vulnerabilities like RCE, SQLi, and XSS.
  • Vulnerability Sweep: Performs bulk checks for common misconfigurations including exposed debug logs, XMLRPC, and CORS credential reflection.

Quick Start

Use the wp-plugin-automation skill to scan the list of domains in targets.txt for known plugin vulnerabilities and generate a report of exploitable targets.

Frequently Asked Questions about wp-plugin-automation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate WordPress plugin vulnerability scanning across multiple domains?▼

Automate WordPress plugin vulnerability scanning by detecting plugin versions via HTTP requests and matching them against known CVE databases to identify exploitable attack surfaces across large domain fleets.

What is the best way to match WordPress plugin versions against known CVEs for bug bounty reconnaissance?▼

The best way to match WordPress plugin versions against CVEs is using an automated matrix that correlates detected versions from REST API endpoints with curated high-impact vulnerabilities like RCE, SQLi, and XSS.

Can I bulk check WordPress sites for exposed debug logs and XMLRPC misconfigurations?▼

Yes, you can perform bulk vulnerability sweeps for common WordPress misconfigurations including exposed debug logs, XMLRPC, and CORS credential reflection to identify additional exploitable targets.

Do I need curl and jq installed to detect WordPress plugin versions via readme.txt?▼

Yes, you need curl and jq installed to perform HTTP requests and parse JSON responses for WordPress plugin version detection, along with python3 for processing the vulnerability reconnaissance workflow.

How does automated CVE detection work for WordPress plugin reconnaissance?▼

Automated CVE detection works by scanning target lists to identify specific WordPress plugin versions via readme.txt and REST API endpoints, then correlating those versions against a curated database of known vulnerabilities.

What limitations exist when scanning large fleets of WordPress domains for plugin vulnerabilities?▼

Scanning large WordPress domain fleets relies on accessible readme.txt and REST API endpoints for version detection, meaning sites that block these endpoints or hide version information may not produce accurate vulnerability matches.

Related Skills

Explore More Software Engineering Skills→
EntroVyxEntroVyx
3

recon-pools

Automate sector-specific reconnaissance for WordPress pool service websites to detect security misconfigurations.

Community
Intermediate
uphiagouphiago
1.1k

wp-plugin-automation

Automates WordPress vulnerability auditing by extracting plugin versions and matching CVEs from batches of target domains.

Community
Intermediate
L3DigitalNetL3DigitalNet
6

nmap

Scan networks for hosts, ports, services, and operating systems using nmap.

Official
Intermediate
uphiagouphiago
1.1k

wp-plugin-cve-hunt

Identify exploitable WordPress plugin CVEs across target domains via version extraction and database cross-referencing.

Community
Advanced