Does anyone know if there is tooling that can scan sites across for this specific vulnerability?

I guess such a tool would basically grep across the webroots of all vhosts for occurences add_query_arg() and remove_query_arg(), and then testing to see if input is sanitized.

Given the co-ordinated response from various vendors and WordPress sec team I can imagine that the expertise exists to produce a tool that can help us check our sites.