CVE Matching Check
VitalSite matches your detected software versions against the NIST National Vulnerability Database to surface known high and critical CVEs.
Most real-world breaches don't use exotic zero-days — they exploit known vulnerabilities in outdated software that was never patched. Once VitalSite fingerprints your stack, it cross-references those versions against the NVD (National Vulnerability Database) maintained by NIST to surface CVEs that may apply to your site.
What VitalSite checks
Using the tech stack fingerprint, we query the free NVD API for the products and versions we detect — your server software, CMS, and generator — and surface known high and critical CVEs, with the identifier and a description so you can confirm whether your exact version is affected.
Why it matters
Outdated, vulnerable software is consistently among the most common website vulnerabilities. Automated bots scan the entire internet for specific vulnerable versions and exploit them at scale — being a small site is no protection. Knowing which CVEs map to your stack tells you exactly what to patch first.
How to fix it
1. Update the affected software. The fix for a known CVE is almost always "upgrade to the patched version." Update your CMS core, plugins, themes, server packages, and dependencies.
2. Confirm the match. CVE matching is a starting signal — verify the CVE applies to your exact version and configuration before acting, since some are conditional.
3. Reduce your attack surface. Remove plugins, modules, and packages you no longer use; each one is a potential CVE.
4. Automate updates where safe, and subscribe to security advisories for your core platform.
For WordPress, outdated plugins are the number-one cause of compromise — the hardening checklist covers update discipline in detail.
Verify the fix
Re-scan after patching. The CVE check should report no matching high/critical CVEs for the now-updated versions. Pair this with hiding version banners in the tech stack check so bots can't easily fingerprint you in the first place.
Run a free full-domain scan to see whether this affects your site — every page, with an exact fix guide. Pro and Agency plans add PDF export and monitoring.
See if this affects your site
Run a free full-domain scan — this check runs on every page, with an exact fix guide.