wp-plugin-cve-hunt

What problem does it solve?

Manual WordPress plugin CVE research is slow and error-prone, with version information often hidden across multiple sources and CVE data scattered across disparate databases, leading to missed critical vulnerabilities during penetration tests.

Core Features & Use Cases

• Multi-Source Version Extraction: Pulls plugin versions from readme.txt, PHP headers, asset paths, and REST API namespaces to avoid false positives from outdated readme files.
• Cross-Database CVE Matching: Queries WPScan, Patchstack, and NVD databases to map extracted versions to known CVEs with severity ratings and fixed version data.
• PoC Generation & False Positive Elimination: Provides exploitation proof-of-concept commands for confirmed CVEs and includes validation checks to confirm endpoints are reachable and versions are accurate before testing.
• Use Case: A red teamer testing 15 WordPress targets can use this skill to quickly identify which plugins have unpatched critical CVEs, cutting hours of manual research into a repeatable workflow that has already found 14 confirmed exploitable CVEs across 58 real-world company targets.

Quick Start

Use the wp-plugin-cve-hunt skill to identify all exploitable CVEs for the WordPress plugins detected on your list of target domains, including version verification and PoC generation for confirmed vulnerabilities.