WPScan is a WordPress vulnerability scanner and intelligence product — a CLI, an API, and a plugin that reports known issues on a site. WP Triage is a risk scoring engine for a whole portfolio. Scanning finds issues; triage decides what to fix first across many installs.
| Capability | WPScan | WP Triage |
|---|---|---|
| CLI / one-off site scanner | Yes | No |
| Vulnerability intelligence API | Yes | Uses WPVulnerability |
| Per-site vulnerability reports | Yes | Yes (ranked) |
| Portfolio risk score (0–100) | No | Yes |
| Cross-site prioritization | No (per scan / per site) | Yes |
| Top 3 issues + fix order | No | Yes |
| PHP EOL / unmaintained plugin detection | Limited | Yes |
| Weekly triage digest | No | Yes |
Use WPScan when you need a dedicated WordPress vulnerability scan, CLI automation, or vulnerability intelligence for a single site or pipeline.
Use WP Triage when you manage many WordPress sites and need a comparable 0–100 score, a top-three issue list, and a recommended fix order — not another scan dump.
WPScan answers “what known vulnerabilities exist on this WordPress site?” That is a real job — especially for a one-off audit, a CI check, or a developer who already knows which install to inspect. WP Triage answers a different question: “across this portfolio, which site is most exposed, and what should we fix first this week?”
A scanner dump on twenty client sites is still a dump. Agencies fail on order, not on a lack of CVE lists. That is why WP Triage always resolves each site to a risk score, a top-three list, and a fix order — and why it also weights PHP end-of-life and unmaintained plugins, not only CVE matches.
WP Triage matches inventory against the public WPVulnerability database. It does not consume the WPScan API. Details are in the scoring methodology.
If the search you actually mean is “WordPress vulnerability scanner alternative,” WPScan, Patchstack, and similar tools remain the category. If the search is “how do I prioritize WordPress security work across clients,” that is WP Triage — see for agencies.
Not as a scanner. WPScan is a WordPress vulnerability scanner and intelligence source — CLI, API, and a per-site plugin. WP Triage is a portfolio decision engine: it matches inventory against known issues, then outputs a 0–100 score, top three issues, and a fix order. Use WPScan when you need a scan; use WP Triage when you need to decide which of many sites to work first.
No. WP Triage matches installed plugins, themes, and core against the public WPVulnerability database, then layers PHP lifecycle and maintenance drift into the same score. WPScan remains a separate scanner and data product.
Yes. Run WPScan (or another scanner) for a deep one-off audit on a site you already flagged. Use WP Triage week to week to sort the whole portfolio so those audits happen on the sites that actually need them.
WP Triage is a decision engine — it complements tools like WPScan rather than replacing them.