[david_shaw]

WPScan was (and maybe still is?) the de facto security scanner for WordPress security problems. I remember using it with great success during my days running security assessments, and it's great that the open source repo is still around.

However, my understanding is that it's no longer maintained -- instead, WPScan is now a private company that sells the product: https://wpscan.com