https://archdioceseofnairobi.org
Scan complete
55 issues detected
Scanned 1 week ago
55
Total
1
Critical
10
High
28
Medium
Plugin 'woocommerce' v4.8.0: WooCommerce < 5.5 - Authenticated Blind SQL Injection
Plugin 'woocommerce' v4.8.0: WooCommerce <= 6.2.0 - Path Traversal via Tax Importer
Plugin 'contact-form-7' v5.2.1: Contact Form 7 <= 5.3.1 - Arbitrary File Upload via Bypass
Plugin 'contact-form-7' v5.2.1: Contact Form 7 <= 5.8.3 - Authenticated (Editor+) Arbitrary File Upload
Plugin 'contact-form-7' v5.2.1: Contact Form 7 <= 5.9.4 - Unauthenticated Open Redirect
Plugin 'contact-form-7' v5.2.1: Contact Form 7 <= 5.9 - Reflected Cross-Site Scripting
Plugin 'contact-form-7' v5.2.1: Contact Form 7 <= 6.0.5 - Order Replay Vulnerability
Plugin 'contact-form-7' v5.2.1: Contact Form 7 [contact-form-7] < 5.3.2
Plugin 'revslider' v6.1.1: Slider Revolution < 6.6.19 - Authenticated (Author+) PHP Object Injection
Plugin 'revslider' v6.1.1: Slider Revolution <= 6.6.15 - Authenticated (Author+) Arbitrary File Upload
Plugin 'revslider' v6.1.1: Slider Revolution <= 6.6.12 - Authenticated (Administrator+) Arbitrary File Upload
Plugin 'revslider' v6.1.1: Slider Revolution <= 6.7.37 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Read
Plugin 'revslider' v6.1.1: Slider Revolution <= 6.7.36 - Authenticated (Contributor+) Arbitrary File Read via 'used_svg' and 'used_images'
Plugin 'wpb-elementor-addons' v1.0: WPB Elementor Addons <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter
Plugin 'wpb-elementor-addons' v1.0: WPB Elementor Addons <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Plugin 'wpb-elementor-addons' v1.0: WPB Elementor Addons <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Plugin 'wpb-elementor-addons' v1.0: WPB Elementor Addons <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Plugin 'wpb-elementor-addons' v1.0: WPB Elementor Addons [wpb-elementor-addons] < 1.2 (closed)
Plugin 'wpb-elementor-addons' v1.0: WPB Elementor Addons [wpb-elementor-addons] < 1.2 (closed)
Plugin 'wpb-elementor-addons' v1.0: WPB Elementor Addons [wpb-elementor-addons] < 1.2 (closed)
Plugin 'wpb-elementor-addons' v1.0: WPB Elementor Addons [wpb-elementor-addons] <= 1.6 (unfixed)
Plugin 'eventON' v1.0: EventON - WordPress Virtual Event Calendar Plugin <= 5.0.11 - Unauthenticated Blind SQL Injection via Search Parameter
Plugin 'eventON' v1.0: EventON <= 2.1 - Insecure Direct Object Reference to Unauthorized Post Access
Plugin 'eventON' v1.0: EventON - WordPress Virtual Event Calendar Plugin Pro <= 4.5.4 & Free <= 2.2.7 - Missing Authorization to Arbitrary Post Meta Update via evo_eventpost_update_meta
Plugin 'eventON' v1.0: EventON - WordPress Virtual Event Calendar Plugin Pro <= 4.5.4 & Free <= 2.2.7 - Cross-Site Request Forgery via evo_eventpost_update_meta
Plugin 'eventON' v1.0: EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.8 (Free) - Cross-Site Request Forgery via save_virtual_event_settings
Plugin 'eventON' v1.0: EventON - WordPress Virtual Event Calendar Plugin <= 4.9.6 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
Plugin 'eventON' v1.0: EventON Pro <= 4.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
Plugin 'eventON' v1.0: EventON <= 3.0.5 - Reflected Cross-Site Scripting
Plugin 'eventON' v1.0: EventON <= 4.4.0 - Reflected Cross-Site Scripting
Plugin 'eventON' v1.0: EventON <= 4.9.12 - Reflected Cross-Site Scripting
Plugin 'elementor' v3.2.5: Elementor <= 3.18.1 - Authenticated(Contributor+) Arbitrary File Upload to Remote Code Execution via Template Import
Plugin 'elementor' v3.2.5: Elementor <= 3.19.0 - Authenticated(Contributor+) Arbitrary File Deletion and PHAR Deserialization
Plugin 'elementor' v3.2.5: Elementor <= 3.12.1 - Authenticated(Administrator+) SQL Injection via 'replace_urls'
Plugin 'elementor' v3.2.5: Elementor Website Builder <= 3.16.4 - Missing Authorization to Arbitrary Attachment Read
Plugin 'elementor' v3.2.5: Elementor Website Builder <= 3.16.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via get_inline_svg()
WP_DEBUG is disabled (no PHP errors visible)
PHP 7.0.33 detected — end of life, no security updates
How to fix: Upgrade PHP to 8.2+ via your hosting control panel. Outdated PHP receives no security patches.
X-Powered-By header exposed: PHP/7.0.33, PleskLin — reveals server software
How to fix: Hide X-Powered-By header. In php.ini set expose_php = Off, or add Header unset X-Powered-By to .htaccess.
Missing security header: X-Frame-Options -- Prevents clickjacking attacks
How to fix: Add to .htaccess: Header always set X-Frame-Options "SAMEORIGIN" — prevents clickjacking attacks.
Missing security header: X-Content-Type-Options -- Prevents MIME-type sniffing
How to fix: Add to .htaccess: Header always set X-Content-Type-Options "nosniff" — prevents MIME-type sniffing.
Missing security header: Strict-Transport-Security -- Enforces HTTPS connections
How to fix: Add to .htaccess or nginx: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Missing security header: Content-Security-Policy -- Controls resource loading
Missing security header: Referrer-Policy -- Controls referrer information
Missing security header: Permissions-Policy -- Controls browser feature access
SSL certificate valid (140 days remaining) — issued by DigiCert Inc
HTTP correctly redirects to HTTPS
REST API user enumeration blocked
wp-cron.php is publicly accessible (potential DDoS vector)
/wp-cron.php
How to fix: Disable WP-Cron in wp-config.php with define("DISABLE_WP_CRON", true) and use a real server cron job instead.
Suspicious inline JavaScript: String.fromCharCode obfuscation
How to fix: Inspect this inline JavaScript carefully — obfuscated code can indicate malware injection.
Suspicious inline JavaScript: unescape() usage
How to fix: Inspect this inline JavaScript carefully — obfuscated code can indicate malware injection.
Suspicious inline JavaScript: unescape() usage
How to fix: Inspect this inline JavaScript carefully — obfuscated code can indicate malware injection.
Suspicious inline JavaScript: unescape() usage
How to fix: Inspect this inline JavaScript carefully — obfuscated code can indicate malware injection.
3 trusted external script(s): maps.googleapis.com (Google), www.google.com (Google), www.googletagmanager.com (Google)
Checked against 11 blacklist services
We found critical security issues. Our experts can clean your site and fix all vulnerabilities within 24 hours.
Get Expert Cleanup — $49