DEFENDORIA SECURITY TOOLS
WordPress Vulnerability Checker
Check published security advisories for a WordPress plugin, theme or core release. Enter the exact version you use to understand known affected ranges and see original sources.
VULNERABILITY INTELLIGENCE
Look up a WordPress component
Data: WPVulnerability
This checks a version you supply against public advisory records. It does not connect to or scan any website.
LOOKUP RESULTS
Published vulnerability advisories
METHODOLOGY
Understand what this lookup tells you.
Security advisories identify known issues in specific component versions. This tool checks a manually entered version against published range operators, when those operators are available.
Core release results may not include exact version operators, so we show them as related advisories rather than confirmed matches.
How to interpret the results
Version in a published affected range
The exact version entered satisfies the advisory’s available range conditions. Review the original record and recommended remediation.
Not enough version detail
Some records lack machine-readable version ranges, or apply to a release family rather than the precise installed patch.
Outside a listed range
The version entered does not match that particular advisory’s range. This is not proof the software is secure.
Common questions
Can this check every plugin installed on my website?
Not automatically. You choose a component slug and version. Verifying a whole site’s inventory requires owner-authorized access and a separate assessment process.
Does a matched advisory mean my website was hacked?
No. A version-range match indicates potential exposure to a reported vulnerability, not evidence of exploitation or compromise.
What if there are no matches?
No matches means no listed range matched the provided version in this source’s current records. Unknown or undisclosed vulnerabilities may still exist.
Are results always up to date?
The data comes from WPVulnerability, an independently maintained project. We cache component records for three hours and display when the lookup occurred. Advisories may be incomplete or corrected later.
Can I verify a WordPress core version?
Yes, but core records do not provide exact range operators in this feed. They are displayed as related advisories, not proof that a particular patch release is affected.