# Free WordPress vulnerability scanner, no plugin | Respira > Check any WordPress site free: core, plugin and theme versions matched against 43,000+ known vulnerabilities from Wordfence. No plugin, no login. Source: https://www.respira.press/wordpress-vulnerability-scanner --- Free · no plugin · no login # Free WordPress vulnerability scanner for plugins, themes and core Respira's free WordPress vulnerability scanner checks a site from its public pages. Enter an address and it reads the WordPress version and the plugins and themes those pages name, then matches every version it can read against 43,747 known vulnerabilities from the Wordfence Intelligence database. Nothing to install, no login, and nothing on the site is changed. It is a known-vulnerability check, not a malware scan. **21 October 2026: two critical flaws in PHP itself** (CVE-2026-109618 and CVE-2026-109619) let anyone run code on a server with no login. Every WordPress site runs on PHP. The fix is PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and only your host can install it. When a server shows its PHP version, the scan below says whether it carries the fix. [What to check and what to ask your host](https://www.respira.press/blog/php-vulnerability-cve-2026-109618-wordpress) A free account adds the full list with CVEs and fixed-in versions, a fix prompt to paste into ChatGPT or Claude, and a weekly re-check. Respira for WordPress goes further: it scans from inside each site, sees every installed plugin with its exact version, and does the fixing once you approve it, with a receipt showing exactly what changed. [Run the full scan free for 7 days](https://www.respira.press/pricing) [How Respira keeps AI edits safe](https://www.respira.press/safe) Vulnerability database last updated **2 hours ago**· refreshed every six hours 2 need an update, 1 has something to check, 3 are clear. Need a look**0**a trace worth confirming Need an update**2**a newer version closes it To check**1**one look, then done All clear**3**nothing to do Last scan**6 min ago**database updated 2 hours ago **Bright Bakery**`brightbakery.com` WordPress`6.9.4` WooCommerce`—` Plugins`21` Core files`Verified` Update needed6 min ago **03**updates**01**to check once 1 note DetailsClose - critical **WordPress `6.9.4` `6.9.7`** August 2026 core security release (XSS2Shell) `CVE-2026-64638` 12 August 2026 core security release `CVE-2026-65640` - \+ 2 Two plugin updates, each listed with the version that fixes it. One check to close this Updating closes the hole. It cannot show whether anything was changed before the patch landed, so look once at application passwords and recently added administrators, then mark it reviewed. **The Copper Kettle**`thecopperkettle.co` WordPress`6.9.7` WooCommerce`—` Plugins`14` Core files`Verified` Update needed6 min ago **01**update no backup plugin DetailsClose The real page lists each item here with the version that fixes it and a button that runs the update once you approve it. **Fern Hollow**`fernhollow.shop` WordPress`6.9.7` WooCommerce`10.1` Plugins`33` Core files`Verified` Something to check6 min ago **01**to check once DetailsClose The real page lists each item here with the version that fixes it and a button that runs the update once you approve it. **Meridian Dental**`meridian-dental.com` WordPress`6.9.7` WooCommerce`—` Plugins`18` Core files`Verified` All clear7 min ago Nothing to do DetailsClose No known vulnerability matches a version installed here, core files match the official checksums, and nothing is waiting for a look. **Otters & Co**`ottersandco.com` WordPress`6.9.7` WooCommerce`—` Plugins`9` Core files`Verified` All clear7 min ago Nothing to do DetailsClose No known vulnerability matches a version installed here, core files match the official checksums, and nothing is waiting for a look. **Salt & Steam Sauna**`saltandsteam.co` WordPress`6.9.7` WooCommerce`—` Plugins`12` Core files`Verified` All clear7 min ago Nothing to do 1 note DetailsClose No known vulnerability matches a version installed here, core files match the official checksums, and nothing is waiting for a look. A scan reads your sites and changes nothing. If the vulnerability database cannot be reached, the result is reported as unknown, never as clean. The Security page, working, with a fictional agency's six sites. Open a row to see what that site needs. ## How to check a WordPress site for vulnerabilities The free scan takes the steps a careful person would take by hand, and it is done within 20 seconds. 1. ### Enter the site address Type the address of any WordPress site into the form at the top of this page, such as example.com. There is no account to create and nothing to install. 2. ### The scanner reads the public pages It requests the page, the RSS feed when the page hides the WordPress version, the public readme.txt of each plugin the page names (up to 40) and the style.css of each theme. It never guesses folder names, never logs in and stops after 20 seconds. 3. ### Each version is matched The WordPress, plugin and theme versions it can read are matched against the Wordfence Intelligence vulnerability database, refreshed every six hours. Anything without a readable version is listed as not checked, never as safe. 4. ### Read the result You see which components have known vulnerabilities and the severity of the worst one. A free account adds every record with its CVE and the version that fixes it, a fix prompt, and a weekly re-check. 5. ### Fix it and check again Update each component to the fixed version the result names, or deactivate it while no fix is published, then run the scan again to confirm it cleared. [Check a site now](#scan) ## Free scan, free account or full scan: what each one checks An outside scan sees what a site shows the public. A scan from inside the site sees everything installed. Here is what changes at each step. Forty seconds, with a voice. The demo site is shop.example.com, a reserved example address; its results are real matches for that set of versions. | Check | Free scan | Free account | Respira for WordPress | | --- | --- | --- | --- | | Where it looks | Public pages only | Public pages only | Inside the site | | Plugins and themes checked | The ones the pages name, with a readable version | The ones the pages name, with a readable version | Every installed one, active or not, with its exact version | | What you see | Affected components and the worst severity | Every record, its CVE and the version that fixes it | Every record, its CVE and the version that fixes it | | The fix | Not included | A fix prompt for ChatGPT, Claude or a developer | The update runs once you approve it, with a receipt | | Checked again | When you run it again | Every week, up to 25 sites | Re-matched against the newest data whenever you open the dashboard | | Core checksums, PHP in uploads, admin accounts, hidden plugins, rewrite rules | No | No | Yes | | Price | Free, no login | Free | 7-day free trial, then a paid plan | Running one of the free plugins, [Inhale](https://www.respira.press/inhale-mcp-abilities)or [Respira ARC](https://www.respira.press/arc)? Connect it to a free account and the weekly check runs from inside the site, so it sees every installed plugin and theme with its exact version. ## Each site says what it needs A security report that lists everything it knows is hard to act on. Respira sorts each site into one of four states, puts the ones that need something at the top, and keeps the detail folded until you open it. Advice about your server, such as PHP being allowed to run from the uploads folder, is labelled advice and never colours a site red. - Needs a look A trace worth confirming by eye: a plugin that hides itself, a changed core file, an administrator nobody created. It is rare, and it is the only state shown in red. - Update needed A version installed on the site has a known vulnerability, and a newer version closes it. The fix is one approval away. - Something to check The site is patched. One look at what a version number cannot show, such as application passwords, then it is closed for good. - All clear Nothing known matches what is installed, core files match the official checksums, and nothing is waiting. ## The whole database, checked on every scan **43,747**known vulnerabilities **16,549**plugins covered **2,176**themes covered **2 hours ago**since the last update A list of thousands of vulnerabilities tells you nothing about your own site. So Respira does not show you the database. It shows you the handful that match a version you actually have installed, each with the version that fixes it. Your last scan is re-checked against the newest database every time you open the dashboard, so a vulnerability published this morning shows up there without a rescan. If you want to read the rest, [the full database is on Wordfence](https://www.wordfence.com/threat-intel/vulnerabilities). Vulnerability data: Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. [Terms](https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/) Attack risk: [EPSS by FIRST](https://www.first.org/epss), the chance of exploitation attempts in the next 30 days. In the news ## The ones everyone is talking about For these, a version check is not enough. Updating closes the hole and leaves anything an attacker created beforehand exactly where it is. So for each one Respira also looks for what the attack is known to leave behind: an application password, an administrator nobody created, a plugin installed in the attack window. Reviewed advisories · reviewed 2026-11-05 · catalog 2026-11-05.1 - critical WordPress 28 October 2026 core security release (CVE-2026-119977, unauthenticated code execution during core updates, exploited in the wild) CVE-2026-119977 [WordPress 7.1.4 release notes](https://wordpress.org/news/2026/10/wordpress-7-1-4/)[Version 7.1.4](https://wordpress.org/documentation/wordpress-version/version-7-1-4/)[Patchstack: every fix in 7.1.4, with the privilege each one needs](https://patchstack.com/articles/wordpress-7-1-4-security-release/)[NVD: CVE-2026-119977](https://nvd.nist.gov/vuln/detail/CVE-2026-119977)[CISA Known Exploited Vulnerabilities catalog (added 3 November 2026)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)[Picus Security: how the upgrade race works, and the server rule that closes it](https://www.picussecurity.com/resource/blog/cve-2026-119977-when-updating-wordpress-becomes-the-vulnerability)[WordPress.org current releases by branch](https://api.wordpress.org/core/version-check/1.7/) - critical PHP 21 October 2026 security release (CVE-2026-109618 and CVE-2026-109619, unauthenticated remote code execution in PHP itself) CVE-2026-109618 · CVE-2026-109619 [php.net security advisory, 21 October 2026](https://www.php.net/archive/2026.php#2026-10-21-5)[WordPress.org: Critical PHP security release (no WordPress update required or planned)](https://wordpress.org/news/2026/10/critical-php-security-release/)[GHSA-w8hw-w9fx-j79w (CVE-2026-109618, RCE via OOM corruption)](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w)[GHSA-6wmf-4rv5-p3rp (CVE-2026-109619, RCE via stale global state)](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp)[PHP 8 changelog, with every fixed release](https://www.php.net/ChangeLog-8.php) - critical UpdraftCentral connection keys stolen from teamupdraft.com and used to install backdoors (October 2026) [TeamUpdraft: Security incident, what customers need to know](https://teamupdraft.com/blog/security-incident-october-2026/)[Search Engine Journal: the fix versions and where to remove old keys](https://www.searchenginejournal.com/updraftplus-wordpress-plugin-security-breach-enables-backdoor-attacks/593909/)[UpdraftPlus on WordPress.org](https://wordpress.org/plugins/updraftplus/) - critical Rank Math SEO PRO 3.0.123 was distributed with a backdoor (CVE-2026-111862) CVE-2026-111862 [Rank Math: PRO 3.0.123 security incident, with every indicator](https://rankmath.com/kb/pro-3-0-123-security-incident/)[Patchstack record: Rank Math SEO PRO 3.0.123, embedded malicious code](https://patchstack.com/database/wordpress/plugin/seo-by-rank-math-pro/vulnerability/wordpress-rank-math-seo-pro-plugin-3-0-123-unauthenticated-embedded-malicious-code-vulnerability)[SecurityWeek: the supply chain attack](https://www.securityweek.com/rank-math-pro-wordpress-plugin-compromised-in-supply-chain-attack/) - critical Bricksforge unauthenticated file upload to remote code execution (CVE-2026-85097, exploited in the wild) CVE-2026-85097 [Patchstack: the flaw, the attacks and the indicators](https://patchstack.com/articles/critical-unauthenticated-arbitrary-file-upload-vulnerability-exploited-in-bricksforge-plugin/)[Wordfence record: Bricksforge <= 3.1.8.9, unauthenticated arbitrary file upload](https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/bricksforge/bricksforge-3189-unauthenticated-arbitrary-file-upload-via-temporaryfileuploads-parameter)[The Hacker News: exploitation in the wild](https://thehackernews.com/2026/10/attackers-exploit-cvss-100-bricksforge.html) - high WordPress 6 October 2026 core security release CVE-2026-66666 [WordPress 7.1.3 release notes](https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/)[Version 7.1.3](https://wordpress.org/documentation/wordpress-version/version-7-1-3/)[WordPress.org current releases by branch](https://api.wordpress.org/core/version-check/1.7/) - critical WordPress 22 September 2026 core security release (CVE-2026-87902, unauthenticated file inclusion in page templates, exploited in the wild) CVE-2026-87902 [WordPress 7.1.2 release notes](https://wordpress.org/news/2026/09/wordpress-7-1-2-release/)[Version 7.1.2](https://wordpress.org/documentation/wordpress-version/version-7-1-2/)[GHSA-7hp8-65ch-5whp, with every patched branch](https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp) - critical Admin Menu Editor Pro 2.35 and 2.36 were distributed with a backdoor [Wordfence record: Admin Menu Editor Pro 2.35 - 2.36, Backdoored Software](https://www.wordfence.com/threat-intel/vulnerabilities/id/8898bae3-067c-4505-9a96-05b7a08d90c6)[BleepingComputer: the incident and the indicators](https://www.bleepingcomputer.com/news/security/malcious-admin-menu-editor-pro-plugin-backdoors-1-500-wordpress-sites/) - high WordPress 17 September 2026 core security release (Click2Shell forced theme install, unauthenticated stored XSS) CVE-2026-93485 [WordPress 7.1.1 release notes](https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/)[Version 7.1.1, with the full backport list](https://wordpress.org/documentation/wordpress-version/version-7-1-1/)[Click2Shell, the reported chain](https://pwn.ai/blog/click2shell) - high WordPress 12 August 2026 core security release (Author+ RCE via Imagick and Ghostscript) CVE-2026-65640 [WordPress 7.0.4 release notes](https://wordpress.org/news/2026/08/wordpress-7-0-4-release/)[Version 7.0.4, with the full backport list](https://wordpress.org/documentation/wordpress-version/version-7-0-4/) - critical WordPress August 2026 core security release (XSS2Shell login-screen XSS) CVE-2026-64638 · CVE-2026-114570 [WordPress 7.0.3 release notes](https://wordpress.org/news/2026/08/wordpress-7-0-3-release/)[Version 7.0.3, with the full backport list](https://wordpress.org/documentation/wordpress-version/version-7-0-3/) - critical WordPress wp2shell pre-authentication RCE chain CVE-2026-60137 · CVE-2026-63030 [WordPress 7.0.2 security release](https://wordpress.org/news/2026/07/wordpress-7-0-2-release/) - critical WooCommerce Store API CSRF admin-account chain [WooCommerce security advisory](https://developer.woocommerce.com/2026/03/02/store-api-vulnerability-patched-in-woocommerce-5-4/) - high Stripe for WooCommerce payment validation issue [Stripe for WooCommerce advisory](https://developer.woocommerce.com/2026/07/14/advisory-stripe-for-woo-patch/) - critical Pods unauthenticated privilege escalation via the pods\_admin AJAX router CVE-2026-19598 [CVE-2026-19598 at NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-19598)[Wordfence advisory](https://www.wordfence.com/threat-intel/vulnerabilities/id/3628032a-3121-45a7-8a78-cfcd8ba6af2f)[Pods on WordPress.org](https://wordpress.org/plugins/pods/) The newest one is in the WordPress updater. **CVE-2026-119977**, fixed in WordPress 7.1.4 on 28 October 2026, lets anyone with no login take over a site during the seconds a core update unpacks, and CISA added it to its list of actively exploited flaws on 3 November. The update to 7.1.4 still runs the old updater, so ask your host to block web access to wp-content/upgrade before updating. The scan checks your branch against its patch, and the full scan lists the administrators created since 28 October. The one before it is not in WordPress at all. On 21 October 2026 PHP itself shipped fixes for CVE-2026-109618 and CVE-2026-109619, two flaws that let anyone run code on a server with no login. No WordPress update or plugin closes them; the host has to update PHP. The scan reads the PHP version when the server shows it, and the full scan checks for what an attacker would leave behind. [The PHP flaws, the fixed versions and the message to send your host](https://www.respira.press/blog/php-vulnerability-cve-2026-109618-wordpress). One easy mix-up. July's WordPress core issue was called **wp2shell**, August's was **XSS2Shell**, and September had two: **Click2Shell** on the 17th, and **CVE-2026-87902** on the 22nd, which is being exploited against live sites. October's 7.1.4 fixed **CVE-2026-119977**, exploited too. Each fix sits one release above the last, so a site patched for one of them can still be a release short of the next. The scan checks your branch against every one of them. Written up in full, with the branch tables and what to check after updating: [Click2Shell and the 17 September core release](https://www.respira.press/blog/click2shell-wordpress-7-1-1-security-release), [how to check and fix wp2shell](https://www.respira.press/blog/fix-wp2shell-wordpress-cve-2026), and [the September 2026 plugin vulnerabilities](https://www.respira.press/blog/wordpress-vulnerabilities-september-2026) on software most sites actually run, including [the one no version number can fix](https://www.respira.press/blog/admin-menu-editor-pro-backdoor-check). ## What the full Respira scan checks inside every WordPress site The free scan stops at what the public pages show. With Respira for WordPress connected, the scan runs from inside the site and checks all of this. ![An orderly set of abstract website pages is measured evenly along two calm emerald inspection lines.](https://www.respira.press/scanner/sites-examined-evenly.webp) ### Every plugin, and WordPress itself Each installed plugin is matched by its folder name and version, and WordPress by its version, against every published vulnerability. Themes are matched too on sites running Respira 8.9.3 or newer. You see only the ones that apply, each with the version that fixes it. ### Core file checksums Against the official WordPress checksums, excluding wp-content because your themes and plugins are yours to change. Changed, unexpected and symlinked core files are treated differently from missing ones. ### Traces of the attacks in the news The exact markers from public advisories, such as known administrator name patterns and known plugin paths, plus the checks learned from a real break-in: PHP that would run from the uploads folder, administrators backdated to hide, and usernames anyone can list. Findings are reported as evidence to investigate, never as an automatic verdict. ### Administrators and application passwords Recently created administrators, changed roles, and existing application passwords. This is the half that an update does not fix. ### Plugins that hide from the plugin list The plugins WordPress is actually running are compared with what the Plugins screen shows and with the files on disk. A plugin that is active and not listed is reported, and so is an active file that carries no plugin header. Needs Respira 9.1.10 or newer. ### Rewrite rules that take over your pages A rule that sends your page addresses somewhere no plugin on the site accounts for is reported together with the pages it shadows. That is how one hidden plugin made a site's legal pages answer "not found" without touching a single page. ### Unexpected PHP files In uploads, caches and mu-plugins, where a webshell lands. A file in a generated cache directory is reported as an observation whose contents were not independently verified, not as proof of a break-in. ### A rescan that proves the fix After an approved update, the next scan is compared with the first one, so the receipt shows what cleared and what is still open. ## What the WordPress scanner cannot see Worth being straight about the edges, stated the same way the product states them when it reports a finding. - Host cron jobs and web server access logs. They sit outside WordPress. - Vulnerabilities nobody has published yet. The database holds what is known, which is why the traces of an attack are checked as well as versions. - Whether an unfamiliar administrator account is legitimate. Respira surfaces it and asks you. - Password, salt and third-party secret rotation, which happens outside Respira and must be verified there. When a scan is truncated, coverage is reported as partial rather than clean. An unmeasured result and a clean result are different facts. ## How it compares with Wordfence, WPScan, Sucuri SiteCheck and Patchstack Each of these does something this scanner does not, and the honest answer is often to run one of them alongside it. Wordfence A plugin you install. Its free version adds a firewall, a malware scanner for core, plugin and theme files, and known-vulnerability checks, with free firewall rules and malware signatures arriving 30 days after paid ones. Respira uses the same Wordfence Intelligence vulnerability data, without installing anything for the first check. WPScan A command-line scanner and an API backed by its own vulnerability database. The free API is for non-commercial use, with a daily request cap. It suits people comfortable in a terminal. Sucuri SiteCheck A free remote scanner focused on malware visible on the page, blocklist status and outdated software. Sucuri says a remote scan has limited access and cannot see server-side files such as backdoors, which is true of any outside scan, this one included. Patchstack A plugin and service with its own vulnerability database. Its paid plans add mitigation rules that block known exploits before you update. Where Respira differs: the first check needs no install and no access, it names the version that fixes each problem, and it carries on to the fix. A free account writes the fix as a prompt you can read before anything runs. With Respira for WordPress the update itself runs once you approve it, and ends in a receipt. If you need a firewall or a malware cleanup, use a tool built for that. ## Approve the WordPress fix. Keep the receipt. ![Four paper stages show a site being scanned, evidence organised, approval held at a gate, and a final receipt produced.](https://www.respira.press/scanner/scan-know-approve-receipt.webp) Finding the problem is the easy half. Respira writes the fix as a prompt you can read before anything runs: which plugins to update, to which version, and what to leave alone. Run it in AER or in the assistant you already use, then scan again. The receipt shows the target URL, versions, checksums, what was covered, what was not, and a site fingerprint so you can prove which site it came from. Some findings have no update to install. A plugin that should not be on the site can be quarantined once you approve it: switched off without running its own code, moved out of the plugins folder, with every file kept as evidence and one step to put it back if it turns out to be yours. A site cleaned that way is written up in [a plugin that was running and not in the plugin list](https://www.respira.press/blog/hidden-wordpress-plugin-not-in-plugin-list). If you run sites for clients, that receipt is the artefact you send them. [Start the free trial](https://www.respira.press/pricing) [Read the full safety model](https://www.respira.press/safe) ## Questions about the WordPress vulnerability scanner Is my WordPress site affected by the PHP vulnerability (CVE-2026-109618)? Every WordPress site runs on PHP, so it is affected until its server runs a fixed PHP. The PHP project fixed CVE-2026-109618 and CVE-2026-109619, two critical remote code execution flaws in PHP itself, on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35\. PHP 8.1 and older get no fix from the PHP project. The free scan shows the PHP version when the server reveals it in its headers; most hide it, so check Tools, then Site Health, then Info, then Server, in WordPress. Can a WordPress plugin fix the PHP vulnerability? No. The flaws are in PHP, which reads the request before WordPress or any plugin loads, so only updating PHP fixes them. That is your host's job, or yours if you run the server. Respira cannot update PHP either. What it can do is tell you which PHP a site runs, give you the message to send your host, and, once connected, check the site for what an attacker would leave behind: PHP files in uploads, changed core files, new administrators and application passwords. What do I ask my host about the PHP security update? Ask them to update the PHP that serves your site to the fixed release for its branch (8.5.12, 8.4.27, 8.3.36 or 8.2.35) or newer, to confirm the fix is included if they run a distribution or long-term support build, and to tell you which interim settings from the php.net advisory are in place if they cannot update today. The blog post on this page has a message you can copy. Is this WordPress vulnerability scanner free? Yes. The public scan is free and needs no login. A free respira.press account adds every record with its CVE and the version that fixes it, a fix prompt, and a weekly re-check of up to 25 sites. Only the full scan from inside the site, part of Respira for WordPress, is paid, after a 7-day free trial. Do I need to install a plugin to scan my WordPress site? No. The scanner reads the site from outside, the way a browser does, so there is nothing to install and no access to give. The trade-off is that it sees only what the public pages show. For a check from inside the site, the free Inhale and ARC plugins can connect to a free account, and Respira for WordPress runs the full scan. What does the free WordPress vulnerability scanner check? The WordPress version and the plugins and themes the site's pages name, each matched by version against 43,000+ known vulnerabilities from the Wordfence Intelligence database, refreshed every six hours. It reads the page source, the RSS feed when needed, each named plugin's public readme.txt and each theme's style.css. It does not guess folder names, try logins or send attack payloads. How accurate is the scan? As accurate as the versions it can read. A version from the WordPress generator tag or a plugin readme.txt is usually right; one read from an asset address can be wrong, and the result says where each version came from. Components with no readable version are listed as not checked. A clean result means nothing known matched the versions that were readable, not that the site is safe. Does it scan for malware? No. The public scan reads version numbers. It does not look for malware, injected code or backdoors, and a site can be infected while running current versions. The full Respira scan, run from inside the site, checks WordPress core files against the official checksums, PHP files in the uploads and cache folders, administrator accounts and application passwords, plugins that hide from the Plugins screen, and rewrite rules that take over pages. It is not a signature-based malware scanner, so a confirmed infection still calls for a cleanup service. How is it different from Wordfence, WPScan or Sucuri SiteCheck? Wordfence is a plugin you install, with a firewall and a malware scanner; this scanner uses the same Wordfence Intelligence vulnerability data without an install. WPScan is a command-line tool and API. Sucuri SiteCheck looks mainly for malware and blocklisting visible from outside. Respira answers one question, which versions on the site have known vulnerabilities and which version fixes each one, and then helps you apply the fix. What should I do when a vulnerability is found? Take a backup, then update the affected plugin, theme or WordPress to the fixed version the result names. If no fix is published, deactivate it until one is. Then check what an update does not undo: administrators and application passwords you do not recognise, recently installed plugins, and PHP files in uploads. Run the scan again to confirm. A free account gives you a fix prompt to paste into ChatGPT or Claude, or to send to your developer. Does the scan change anything on my site? No. It makes a handful of ordinary page requests, the same kind a browser makes: the page, sometimes the feed, and at most 40 plugin readme files and 6 theme stylesheets. It never logs in, submits a form or tries an exploit, and it stops after 20 seconds. How do I check my WordPress plugins for known vulnerabilities? Compare the version of each installed plugin, and of WordPress itself, with the published vulnerability records for that software. Respira does this on every scan against the Wordfence Intelligence database, refreshed every six hours, and lists only the vulnerabilities that apply to the versions installed, each with the version that fixes it. How do I check if my WordPress site is affected by CVE-2026-119977? Compare your WordPress version against the patched release for your branch: 7.1.4, 7.0.8, 6.9.11, 6.8.12, 6.7.11, 6.6.11, 6.5.14, 6.4.14, 6.3.14, 6.2.15 or 6.1.16, with backports down to 4.7.39\. Below your branch patch means you are missing the 28 October 2026 security release, which fixes CVE-2026-119977: while a core update unpacks, anyone with no login can reach the installer in wp-content/upgrade and take over the site. It is being exploited, and CISA added it to its Known Exploited Vulnerabilities catalog on 3 November 2026\. The update to the fixed release still runs the old updater, so ask your host to block web access to wp-content/upgrade before you update. If your site updated on or after 28 October, check for administrators you did not create. How do I check if my WordPress site is affected by CVE-2026-87902? Compare your WordPress version against the patched release for your branch: 7.1.2, 7.0.6, 6.9.9, 6.8.10, 6.7.9, 6.6.9, 6.5.12, 6.4.12, 6.3.12, 6.2.13 or 6.1.14, with backports down to 4.7.37\. Below your branch patch means you are missing the 22 September 2026 security release, which fixes CVE-2026-87902: with no login, an attacker can make WordPress load a PHP file from outside the active theme, and run code on the server when the theme and the server meet further conditions. It is being exploited against live sites, and CISA added it to its Known Exploited Vulnerabilities catalog on 25 September 2026\. The 17 September patches do not cover it. How do I check if my WordPress site is affected by Click2Shell or CVE-2026-93485? Compare your WordPress version against the patched release for your branch: 7.1.1, 7.0.5, 6.9.8, 6.8.9, 6.7.8, 6.6.8, 6.5.11, 6.4.11, 6.3.11, 6.2.12 or 6.1.13, with backports down to 4.7.36\. Below your branch patch means you are missing the 17 September 2026 security release, which fixes eleven issues. Two carry the news: a forced theme install and preview that researchers chain to code execution and call Click2Shell, and an unauthenticated stored cross-site scripting flaw in wpautop() tracked as CVE-2026-93485\. WordPress rates its own fix for the forced install medium; the higher figure quoted in the press is the researchers' rating for the full chain, which also needs a logged-in administrator to open a crafted link and a theme whose own handler runs the attacker's code. The August patches do not cover this release. A newer core security release shipped on 28 October 2026: 7.1.4, 7.0.8, 6.9.11, 6.8.12, 6.7.11, 6.6.11, 6.5.14, 6.4.14, 6.3.14, 6.2.15 or 6.1.16, with backports down to 4.7.39\. A site on the Click2Shell patch still needs that one to be current. How do I check if my WordPress site is affected by CVE-2026-64638 (XSS2Shell)? Compare your WordPress version against the patched release for your branch: 7.0.3, 6.9.6, 6.8.7, 6.7.6, 6.6.6, 6.5.9, 6.4.9, 6.3.9, 6.2.10, 6.1.11 or 6.0.13, with backports down to 4.7.34\. If you are below your branch patch you are missing the 6 August 2026 security release. Being patched for the earlier wp2shell chain is not enough, because those patches sit one release lower on every shared branch. A newer core security release shipped on 28 October 2026: 7.1.4, 7.0.8, 6.9.11, 6.8.12, 6.7.11, 6.6.11, 6.5.14, 6.4.14, 6.3.14, 6.2.15 or 6.1.16, with backports down to 4.7.39\. A site on the XSS2Shell patch still needs that one to be current. How do I find a WordPress plugin that is active but not in the plugin list? Compare the active plugins stored in the database with what the Plugins screen lists and with the folders in wp-content/plugins. A plugin that is active in the database and missing from the screen is hiding itself. Respira runs that comparison on every scan from plugin version 9.1.10, reports the plugin, and can quarantine it once you approve: switched off without running its own code, moved out of the plugins folder, with its files kept as evidence. Is my WordPress site hacked if I was running a vulnerable version? A vulnerable version means the site could be taken, not that it was. Updating closes the hole but does not undo a break-in. Check for application passwords you do not recognise, administrators created recently, plugins installed recently, and unexpected PHP files in uploads and mu-plugins.