Will this tell me if a plugin has a known vulnerability?

No. It reports the versions your site advertises. Matching those against a vulnerability database is a different exercise, and this check deliberately does not do it — the output is a maintenance list, not a target list.

Does hiding the version make my site secure?

No. It removes a piece of advertising, which is worth a little. The version is frequently still inferable from asset paths, and an out-of-date install is out of date whether or not it says so.

Why is a plugin listed with no version?

Because its assets carried none. It is listed as present and unversioned rather than assumed current, since a check cannot honestly report a number nobody published.

Tools

WordPress version checker

A WordPress version check reports the core, plugin and theme versions a site publishes about itself — in the generator meta tag, in the query string appended to core assets, and in the folder names and asset versions of plugins and themes already loaded by the crawled pages. Nothing is enumerated and nothing is guessed. A component is never described as outdated without a version that was really observed, because a claim about a version nobody saw is a claim about nothing.

Where a version becomes public

The generator meta tag, which WordPress emits by default and which states the core version outright.

The version query string appended to core stylesheets and scripts, which carries the same number in a place most people never look at.

Plugin asset paths, which name the plugin folder, and plugin asset versions, which frequently name its release.

Theme asset paths and their stylesheet version, which do the same for the active theme.

All of these come from pages the crawler already fetched. Nothing probes a plugin directory and nothing requests a path to see whether a component exists.

The rule that governs every finding here

No version observed means no version reported. A component whose assets carry no version is listed as present without one, not guessed at from behaviour.

No component is called outdated without an observed version. An unversioned plugin could be current or four years old, and the honest report says which of those it cannot tell.

No version is matched against a vulnerability database. What this produces is a list of advertised versions to compare against the release pages, not a list of things to exploit.

Absence of a version is not a clean result either. It means the check could not see one, which is a different statement from the component being up to date.

What to do with the list

Compare each advertised version with the component's own release page and update the ones behind. Plugins first: an unmaintained plugin is the most common entry point into a WordPress site, and that is a maintenance fact rather than a scare.

Delete what is not in use. An inactive plugin or an unused theme is still on disk and still updateable, and an unused theme left installed is a component nobody watches.

Consider removing the generator meta tag. It reduces what is advertised and it does not make the site secure — the version is often inferable from asset paths anyway, and the real work is the update.

Treat an abandoned component as more urgent than an out-of-date one. A plugin whose last release is years old will not get the next fix.

The limits, stated plainly

Only publicly advertised versions are read. A site that strips its version information produces an honest report with very little in it.

Only components whose assets appeared in the crawled pages are listed. A plugin active on a page the crawl did not reach is not in the inventory.

No enumeration and no brute force of plugin or theme directories, so the list is what the site published rather than what it has installed.

No comparison against any vulnerability database. Deciding what an outdated version means for you is a job this check hands back to you with the evidence.

What VeriFixScan uses

`wordpress.version` reports the core version when it is published. `wordpress.plugins` lists plugins whose assets were observed, and `wordpress.themes` does the same for themes.

`wordpress.outdated_plugins` and `wordpress.outdated_themes` report advertised versions, and only where a version was really observed.

`wordpress.posture` summarises the picture across these, and `wordpress.seo_plugin` notes whether an SEO plugin is among the components detected.

Frequently asked questions

Will this tell me if a plugin has a known vulnerability?: No. It reports the versions your site advertises. Matching those against a vulnerability database is a different exercise, and this check deliberately does not do it — the output is a maintenance list, not a target list.
Does hiding the version make my site secure?: No. It removes a piece of advertising, which is worth a little. The version is frequently still inferable from asset paths, and an out-of-date install is out of date whether or not it says so.
Why is a plugin listed with no version?: Because its assets carried none. It is listed as present and unversioned rather than assumed current, since a check cannot honestly report a number nobody published.

Sources

VeriFixScan crawls a site and applies its checks to every page it reaches, keeping the evidence behind each finding. Scanning one website is free.

Scan a website