Which version does your site run, and is it vulnerable?

Enter a website address: we read the page and the files the site sends to every visitor and find its Next.js or WordPress version. For Next.js you can also type the version from package.json or npm ls next.

It reads only the page, its JavaScript files and the RSS feed the site serves to everyone, and sends no attack payloads. The version comes from Next.js's own bootstrap code, verified against real builds: Next.js 10.2 to 16.4, WordPress 4.9 to 7.1. Results stay in memory for 10 minutes, then are dropped; nothing is logged.

From the GitHub Advisory Database (CC-BY-4.0), updated 2026-10-31.