Security Scan Results

Plugin 'greenshift-animation-and-page-builder-blocks' v7.3.5: Greenshift – animation and page builder blocks <= 7.6.2 - Authenticated (Administrator+) Arbitrary File Upload

Plugin 'greenshift-animation-and-page-builder-blocks' v7.3.5: Greenshift – animation and page builder blocks <= 12.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Chart Data Attributes

Plugin 'greenshift-animation-and-page-builder-blocks' v7.3.5: Greenshift <= 11.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

Plugin 'greenshift-animation-and-page-builder-blocks' v7.3.5: Greenshift – animation and page builder blocks <= 12.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

Plugin 'greenshift-animation-and-page-builder-blocks' v7.3.5: Greenshift <= 12.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via disablelazy Attribute

Plugin 'greenshift-animation-and-page-builder-blocks' v7.3.5: Greenshift <= 11.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Plugin 'greenshift-animation-and-page-builder-blocks' v7.3.5: Greenshift – animation and page builder blocks <= 9.0.0 - Missing Authorization to Authenticated (Subscriber+) Server-Side Request Forgery and Stored Cross-Site Scripting

WP_DEBUG is disabled (no PHP errors visible)

Missing security header: Content-Security-Policy -- Controls resource loading

Missing security header: Permissions-Policy -- Controls browser feature access

4 of 6 security headers configured

SSL certificate valid (34 days remaining) — issued by Let's Encrypt

HTTP correctly redirects to HTTPS

REST API user enumeration blocked

wp-cron.php is publicly accessible (potential DDoS vector)

/wp-cron.php

How to fix: Disable WP-Cron in wp-config.php with define("DISABLE_WP_CRON", true) and use a real server cron job instead.

1 trusted external script(s): challenges.cloudflare.com (Security)