Security Scan Results

https://archdioceseofnairobi.org

F

Critical — Immediate Action Needed

55 issues detected

Scanned 1 week ago

55

Total

1

Critical

10

High

28

Medium

High

Plugin 'woocommerce' v4.8.0: WooCommerce < 5.5 - Authenticated Blind SQL Injection

High

Plugin 'woocommerce' v4.8.0: WooCommerce <= 6.2.0 - Path Traversal via Tax Importer

High

Plugin 'contact-form-7' v5.2.1: Contact Form 7 <= 5.3.1 - Arbitrary File Upload via Bypass

Medium

Plugin 'contact-form-7' v5.2.1: Contact Form 7 <= 5.8.3 - Authenticated (Editor+) Arbitrary File Upload

Medium

Plugin 'contact-form-7' v5.2.1: Contact Form 7 <= 5.9.4 - Unauthenticated Open Redirect

Medium

Plugin 'contact-form-7' v5.2.1: Contact Form 7 <= 5.9 - Reflected Cross-Site Scripting

Medium

Plugin 'contact-form-7' v5.2.1: Contact Form 7 <= 6.0.5 - Order Replay Vulnerability

Unknown

Plugin 'contact-form-7' v5.2.1: Contact Form 7 [contact-form-7] < 5.3.2

High

Plugin 'revslider' v6.1.1: Slider Revolution < 6.6.19 - Authenticated (Author+) PHP Object Injection

High

Plugin 'revslider' v6.1.1: Slider Revolution <= 6.6.15 - Authenticated (Author+) Arbitrary File Upload

High

Plugin 'revslider' v6.1.1: Slider Revolution <= 6.6.12 - Authenticated (Administrator+) Arbitrary File Upload

Medium

Plugin 'revslider' v6.1.1: Slider Revolution <= 6.7.37 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Read

Medium

Plugin 'revslider' v6.1.1: Slider Revolution <= 6.7.36 - Authenticated (Contributor+) Arbitrary File Read via 'used_svg' and 'used_images'

Medium

Plugin 'wpb-elementor-addons' v1.0: WPB Elementor Addons <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter

Medium

Plugin 'wpb-elementor-addons' v1.0: WPB Elementor Addons <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

Medium

Plugin 'wpb-elementor-addons' v1.0: WPB Elementor Addons <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

Medium

Plugin 'wpb-elementor-addons' v1.0: WPB Elementor Addons <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

Unknown

Plugin 'wpb-elementor-addons' v1.0: WPB Elementor Addons [wpb-elementor-addons] < 1.2 (closed)

Unknown

Plugin 'wpb-elementor-addons' v1.0: WPB Elementor Addons [wpb-elementor-addons] < 1.2 (closed)

Unknown

Plugin 'wpb-elementor-addons' v1.0: WPB Elementor Addons [wpb-elementor-addons] < 1.2 (closed)

Unknown

Plugin 'wpb-elementor-addons' v1.0: WPB Elementor Addons [wpb-elementor-addons] <= 1.6 (unfixed)

Critical

Plugin 'eventON' v1.0: EventON - WordPress Virtual Event Calendar Plugin <= 5.0.11 - Unauthenticated Blind SQL Injection via Search Parameter

High

Plugin 'eventON' v1.0: EventON <= 2.1 - Insecure Direct Object Reference to Unauthorized Post Access

Medium

Plugin 'eventON' v1.0: EventON - WordPress Virtual Event Calendar Plugin Pro <= 4.5.4 & Free <= 2.2.7 - Missing Authorization to Arbitrary Post Meta Update via evo_eventpost_update_meta

Medium

Plugin 'eventON' v1.0: EventON - WordPress Virtual Event Calendar Plugin Pro <= 4.5.4 & Free <= 2.2.7 - Cross-Site Request Forgery via evo_eventpost_update_meta

Medium

Plugin 'eventON' v1.0: EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.8 (Free) - Cross-Site Request Forgery via save_virtual_event_settings

Medium

Plugin 'eventON' v1.0: EventON - WordPress Virtual Event Calendar Plugin <= 4.9.6 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting

Medium

Plugin 'eventON' v1.0: EventON Pro <= 4.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting

Medium

Plugin 'eventON' v1.0: EventON <= 3.0.5 - Reflected Cross-Site Scripting

Medium

Plugin 'eventON' v1.0: EventON <= 4.4.0 - Reflected Cross-Site Scripting

Medium

Plugin 'eventON' v1.0: EventON <= 4.9.12 - Reflected Cross-Site Scripting

High

Plugin 'elementor' v3.2.5: Elementor <= 3.18.1 - Authenticated(Contributor+) Arbitrary File Upload to Remote Code Execution via Template Import

High

Plugin 'elementor' v3.2.5: Elementor <= 3.19.0 - Authenticated(Contributor+) Arbitrary File Deletion and PHAR Deserialization

Medium

Plugin 'elementor' v3.2.5: Elementor <= 3.12.1 - Authenticated(Administrator+) SQL Injection via 'replace_urls'

Medium

Plugin 'elementor' v3.2.5: Elementor Website Builder <= 3.16.4 - Missing Authorization to Arbitrary Attachment Read

Medium

Plugin 'elementor' v3.2.5: Elementor Website Builder <= 3.16.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via get_inline_svg()

Info

WP_DEBUG is disabled (no PHP errors visible)

High

PHP 7.0.33 detected — end of life, no security updates

How to fix: Upgrade PHP to 8.2+ via your hosting control panel. Outdated PHP receives no security patches.

Low

X-Powered-By header exposed: PHP/7.0.33, PleskLin — reveals server software

How to fix: Hide X-Powered-By header. In php.ini set expose_php = Off, or add Header unset X-Powered-By to .htaccess.

Medium

Missing security header: X-Frame-Options -- Prevents clickjacking attacks

How to fix: Add to .htaccess: Header always set X-Frame-Options "SAMEORIGIN" — prevents clickjacking attacks.

Medium

Missing security header: X-Content-Type-Options -- Prevents MIME-type sniffing

How to fix: Add to .htaccess: Header always set X-Content-Type-Options "nosniff" — prevents MIME-type sniffing.

Medium

Missing security header: Strict-Transport-Security -- Enforces HTTPS connections

How to fix: Add to .htaccess or nginx: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

Info

Missing security header: Content-Security-Policy -- Controls resource loading

Info

Missing security header: Referrer-Policy -- Controls referrer information

Info

Missing security header: Permissions-Policy -- Controls browser feature access

Info

SSL certificate valid (140 days remaining) — issued by DigiCert Inc

Info

HTTP correctly redirects to HTTPS

Info

REST API user enumeration blocked

Low

wp-cron.php is publicly accessible (potential DDoS vector)

/wp-cron.php

How to fix: Disable WP-Cron in wp-config.php with define("DISABLE_WP_CRON", true) and use a real server cron job instead.

Medium

Suspicious inline JavaScript: String.fromCharCode obfuscation

How to fix: Inspect this inline JavaScript carefully — obfuscated code can indicate malware injection.

Medium

Suspicious inline JavaScript: unescape() usage

How to fix: Inspect this inline JavaScript carefully — obfuscated code can indicate malware injection.

Medium

Suspicious inline JavaScript: unescape() usage

How to fix: Inspect this inline JavaScript carefully — obfuscated code can indicate malware injection.

Medium

Suspicious inline JavaScript: unescape() usage

How to fix: Inspect this inline JavaScript carefully — obfuscated code can indicate malware injection.

Info

3 trusted external script(s): maps.googleapis.com (Google), www.google.com (Google), www.googletagmanager.com (Google)

Checked against 11 blacklist services

Spamhaus DBL
SURBL
URIBL
SpamEatingMonkey
Barracuda
SORBS
Invaluement
URLhaus
OpenPhish
Google Safe Browsing
VirusTotal (70+ engines)

Your site needs immediate attention

We found critical security issues. Our experts can clean your site and fix all vulnerabilities within 24 hours.

Get Expert Cleanup — $49
Scan another site