wp-security-review

Identify WordPress security vulnerabilities and generate reports with PoCs.

Updated Feb 12, 2026

Search Tags:#security #xss #audit #vulnerabilities #wordpress #csrf #sqli

Ready to run

npx skills add https://github.com/obenland/dotfiles --skill wp-security-review

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: wp-security-review
Source: https://github.com/obenland/dotfiles/tree/main/claude/.claude/skills/wp-security-review
Command: npx skills add https://github.com/obenland/dotfiles --skill wp-security-review

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill provides a comprehensive WordPress security audit by analyzing code for XSS, SQLi, CSRF, SSRF, LFI, Object Injection, Command Injection, Auth Bypass, and Options Manipulation, then reports findings with PoCs and remediation guidance.

Core Features & Use Cases

Parallel, category-specific analysis of WordPress codebases to identify common and advanced vulnerabilities.
Generates actionable vulnerability reports including PoC payloads and recommended fixes.
Suitable for plugin/theme reviews, custom blocks, REST endpoints, and admin workflows to ensure secure deployments.

Quick Start

Run a full-codebase audit on the target WordPress plugin or theme directory to produce a prioritized security report.

Frequently Asked Questions about wp-security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit a WordPress plugin for security vulnerabilities like XSS and SQLi?▼

You can perform a comprehensive WordPress security audit by running a parallel analysis across the codebase to detect XSS, SQLi, CSRF, SSRF, LFI, and other vulnerabilities, yielding a consolidated report with PoCs and remediation steps.

What types of security vulnerabilities can be detected in WordPress theme and plugin code?▼

Vulnerability detection covers XSS, SQLi, CSRF, SSRF, Open Redirect, LFI, Object Injection, Command Injection, Auth Bypass, and Options Manipulation within WordPress codebases to ensure secure deployments.

Can I get proof of concept payloads and remediation guidance for WordPress security findings?▼

Yes, security audits generate actionable vulnerability reports that include PoC payloads demonstrating the exploit and recommended fixes providing context for developers to patch the code.

Does parallel security auditing work for WordPress REST endpoints and custom blocks?▼

Yes, parallel security auditing effectively reviews WordPress REST endpoints, custom blocks, plugins, themes, and admin workflows to identify and report vulnerabilities across multiple categories.

How does parallel subagent analysis improve WordPress security code reviews?▼

Parallel subagent analysis improves WordPress security code reviews by simultaneously scanning distinct vulnerability categories like XSS, SQLi, and CSRF, producing a consolidated vulnerability report with PoCs and remediation guidance.