Check a CMS for known vulnerabilities

This is a passive check. CheckWeb reads only what a site shows any visitor: the version fingerprint in the generator tag or asset paths, the libraries a page loads, the response headers, the TLS certificate. It never probes an admin panel, never sends payloads, never tests logins. That is why anyone can safely scan any site.

The deeper, active checks (exposed backups, open admin panels, an exposed `.git` or `.env`) run only on a domain proven to belong to the person requesting them. CheckWeb detects from the outside and never breaks in.

Under the Security axis, the report shows a line reading "CMS known vulnerabilities" with a red FAIL status and evidence naming the detected engine, its version, and the per-version CVE count: for example Drupal 7.58 with dozens of known CVEs at Critical severity. Alongside it sit "Vulnerable front-end libraries" for anything a module or extension bundles, plus the security headers and TLS status. Together they form the passive picture of how exposed a site is right now.

• Update the core to the latest release. This alone clears the largest CVE count. The update lives in the admin dashboard on every engine: Joomla under System then Update, Drupal under Reports then Available updates, TYPO3 in the Upgrade module, Magento and PrestaShop through their release or Composer process.
• Update every module, extension, plugin, and theme, since that is where most bundled vulnerable libraries hide. Remove the ones that go unused.
• Stop broadcasting the version (the generator meta tag and the `?ver=` query string on assets), so the site is not advertising exactly which CVEs apply.
• Add the core security headers most templates omit. (See the security headers check.)
• Keep auto-updates on for security releases where the engine supports them, then re-scan to confirm the Security axis recovered.

Which content management systems does this cover?

The passive scan detects and version-checks the major self-hosted engines: WordPress, Joomla, Drupal, TYPO3, Magento (Adobe Commerce), PrestaShop, and 1C-Bitrix. WordPress has its own dedicated guide. Hosted platforms such as Shopify, Wix, and Squarespace are detected by name but not version-checked, since their vendor patches them centrally.

Is it safe to scan a site running a CMS?

Yes. The scan is passive: it reads only what the site shows any visitor, such as the version fingerprint, loaded libraries, response headers, and the TLS certificate. It never probes an admin panel, sends payloads, or tests logins, so scanning cannot affect the site.

How does CheckWeb count CMS CVEs?

It detects the core version from what a page reveals, then counts only the CVEs whose affected range includes that version, using the NVD advisory ranges, with the maximum severity computed over the same set. The number reflects the running version, not the lifetime total.

Does the scan check modules, extensions, and themes?

The passive scan detects vulnerable front-end libraries that a module, extension, or theme bundles into the page, and flags an outdated core with known CVEs. Enumerating every installed add-on needs active probing, which runs only on a domain verified as belonging to the requester.

• Vulnerable JavaScript librariesThe other half of the same picture: the outdated jQuery or Bootstrap a module, extension, or theme brings along.
• WordPress securityRunning WordPress specifically? The dedicated guide covers core CVEs, the plugins and themes that bundle vulnerable libraries, and what a passive scan sees.