Wave radar
When a major vulnerability wave hits the news, we publish a check page within 24 hours. Subscribe on any report and we re-check your site on every new wave.
Earlier waves
Major vulnerability waves from the past, added as background. We did not publish these pages at the time; the date shown is when each flaw was disclosed and fixed. The check works the same way.
Was my site affected by WordPress CVE-2026-87902?
On 22 September 2026 WordPress 7.1.2 fixed a flaw in how WordPress core picks page templates (CVE-2026-87902). An attacker who is not logged in could make WordPress load a PHP file from outside the theme, and on servers and themes that meet certain conditions run their own code. Attack traffic started the same day, and CISA listed the flaw as exploited three days later. The fix was backported to every branch from 4.7. This check compares the WordPress version your site shows with the fixed releases.
Was my site affected by wp2shell?
On 17 July 2026 WordPress 7.0.2 fixed two flaws in WordPress core (CVE-2026-60137 and CVE-2026-63030) that, chained together, let an attacker who is not logged in run code on WordPress 6.9 and 7.0 sites. The pair became known as wp2shell and was exploited within days. This check reads the WordPress version your site shows and compares it with the fixed releases.
Was my site affected by PHP-CGI CVE-2024-4577?
On 6 June 2024 PHP 8.3.8, 8.2.20 and 8.1.29 fixed CVE-2024-4577, a flaw in PHP running as CGI on Windows. Under some Windows language settings an attacker who is not logged in could run code on the server. It was used to spread ransomware within days. It does not affect PHP on Linux. This check reads the PHP version and the server platform your site shows.
Was my site affected by the Apache 2.4.49 path traversal?
In October 2021 the Apache HTTP Server project fixed CVE-2021-41773, a path traversal flaw in Apache 2.4.49 that was already being exploited. The first fix in 2.4.50 was incomplete (CVE-2021-42013), and 2.4.51 followed two days later. Only 2.4.49 and 2.4.50 are affected. This check reads the Apache version your server reports.
Was my shop affected by WooCommerce CVE-2021-32789?
In July 2021 WooCommerce fixed an SQL injection in its Store API (CVE-2021-32789) that let anyone read data from a shop's database without logging in. It affected WooCommerce 3.3 to 5.5. WooCommerce patched more than 90 releases of WooCommerce and WooCommerce Blocks and pushed the update to shops automatically. This check reads the WooCommerce version your shop shows and compares it with the fixed release of its line.