Free tool
See the WordPress version, plugins, and theme a site shows, checked against known vulnerabilities, plus the files that give too much away.
example.com
High severity at worst. Fixed in 6.0.6.
How to fix: Update Contact Form 7 to 6.0.6 or newer (Plugins, after a backup).
Elementor 3.31.2, Yoast SEO 26.1, and 6 more.
Every check reads only what the site and its public DNS show. Nothing is signed in to, submitted, or attacked.
The scan only reads public pages and files any visitor could open. It never signs in, guesses passwords, or tries an exploit, so it is safe to run on any site.
From Wordfence Intelligence, a free vulnerability database. We copy its feed once a day into our own systems and check against that copy, so your scan is never sent to anyone else.
A site only shows what its pages load. Some plugins hide their version, and some load nothing on the home page. A scan from inside WordPress, which MountDev Maintenance runs daily, sees every plugin and version.
Update it to the fixed version shown, after a backup. If no fix exists yet, deactivate it or replace it with another plugin until its developer releases one.