Scan WordPress plugins and themes for vulnerabilities with WPScan and email
Ready for 3.0Ready for 3.0. This template uses no nodes that n8n 3.0 removes. No removed nodes, versions or helpers found. Static check, last run 2026-10-19.
What this workflow does
This workflow has 16 nodes and runs on a schedule (every day at 03:00). It uses only n8n's built-in nodes. It also calls wpscan.com over HTTP.
How it runs
Trigger: On a schedule (every day at 03:00).
- Scan settings (Edit Fields (Set)): sets 6 fields: site_url, wp_core_version, max_lookups_per_run…
- Check your settings (Code): runs custom JavaScript code
- Ask WPScan how much quota is left (HTTP Request): calls wpscan.com
- List the plugins (HTTP Request): calls an HTTP API
- List the themes (HTTP Request): calls an HTTP API
- Read the scan history (Data table): get
- Plan the lookups (Code): runs custom JavaScript code
- Anything to look up? (If): checks a condition and branches into true / false
- One component at a time (Loop Over Items (Split in Batches)): loops over the items in batches
- Build the report (Code): runs custom JavaScript code
…plus 5 more steps. See the full node list below.
HTTP calls to: wpscan.com
Before you upgrade to n8n 3.0
Nothing in this workflow is removed in n8n 3.0, so it should import and run after the upgrade.
Nodes used (8)
- Schedule Trigger
n8n-nodes-base.scheduleTrigger - Edit Fields (Set)
n8n-nodes-base.set - Code
n8n-nodes-base.code - HTTP Request
n8n-nodes-base.httpRequest - Data table
n8n-nodes-base.dataTable - If
n8n-nodes-base.if - Loop Over Items (Split in Batches)
n8n-nodes-base.splitInBatches - Send Email
n8n-nodes-base.emailSend
From the author
Quick overview This workflow runs nightly to inventory your WordPress plugins and themes via the WordPress REST API, checks them against the WPScan vulnerability database within your API quota, stores scan history in an n8n Data Table, and emails a report of…