Security Scan Results
https://hlf.com.ar
Scan complete
hlf.com.ar
Critical — Immediate Action Needed
39 issues detected
Scanned 3 weeks ago
39
Total
1
Critical
9
High
14
Medium
WordPress 6.0: WordPress Core < 6.0.3 - SQL Injection via WP_Date_Query
WordPress version 6.0 detected
Plugin 'translatepress-multilingual' v2.2.7: TranslatePress <= 2.10.2 - Unauthenticated PHP Object Injection
Plugin 'translatepress-multilingual' v2.2.7: TranslatePress <= 2.9.6 - Authenticated (Administrator+) PHP Object Injection
Plugin 'translatepress-multilingual' v2.2.7: TranslatePress <= 2.3.2 - Authenticated (Administrator+) SQL Injection
Plugin 'translatepress-multilingual' v2.2.7: TranslatePress <= 3.2.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content
Plugin 'translatepress-multilingual' v2.2.7: TranslatePress <= 3.2.5 - Reflected Cross-Site Scripting
Plugin 'translatepress-multilingual' v2.2.7: Translate Multilingual sites – TranslatePress <= 2.7.5 - Cross-Site Request Forgery
Plugin 'translatepress-multilingual' v2.2.7: Translate Multilingual sites – TranslatePress [translatepress-multilingual] < 2.3.3
Plugin 'translatepress-multilingual' v2.2.7: Translate Multilingual sites – TranslatePress [translatepress-multilingual] < 2.7.6
Plugin 'duracelltomi-google-tag-manager' v1.16: GTM4WP <= 1.22.3 - Unauthenticated Stored Cross-Site Scripting via WooCommerce Billing Fields
Plugin 'contact-form-7' v5.6.1: Contact Form 7 <= 5.8.3 - Authenticated (Editor+) Arbitrary File Upload
Plugin 'contact-form-7' v5.6.1: Contact Form 7 <= 5.9.4 - Unauthenticated Open Redirect
Plugin 'contact-form-7' v5.6.1: Contact Form 7 <= 5.9 - Reflected Cross-Site Scripting
Plugin 'contact-form-7' v5.6.1: Contact Form 7 <= 6.0.5 - Order Replay Vulnerability
Plugin 'real-time-auto-find-and-replace' v1.4.0: Better Find and Replace <= 1.6.7 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
Plugin 'real-time-auto-find-and-replace' v1.4.0: Better Find and Replace <= 1.7.7 - Authenticated (Subscriber+) Limited Code Injection
Plugin 'real-time-auto-find-and-replace' v1.4.0: Better Find and Replace <= 1.6.1 - Unauthenticated PHP Object Injection
Plugin 'real-time-auto-find-and-replace' v1.4.0: Better Find and Replace – AI-Powered Suggestions <= 1.7.9 - Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Image Title
Plugin 'real-time-auto-find-and-replace' v1.4.0: Better Find and Replace <= 1.7.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
Plugin 'real-time-auto-find-and-replace' v1.4.0: Better Find and Replace <= 1.7.7 - Missing Authorization
WP_DEBUG is disabled (no PHP errors visible)
Missing security header: X-Content-Type-Options -- Prevents MIME-type sniffing
How to fix: Add to .htaccess: Header always set X-Content-Type-Options "nosniff" — prevents MIME-type sniffing.
Missing security header: Strict-Transport-Security -- Enforces HTTPS connections
How to fix: Add to .htaccess or nginx: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Missing security header: Content-Security-Policy -- Controls resource loading
Missing security header: Referrer-Policy -- Controls referrer information
Missing security header: Permissions-Policy -- Controls browser feature access
1 of 6 security headers configured
SSL certificate valid (88 days remaining) — issued by Let's Encrypt
HTTP correctly redirects to HTTPS
WordPress license file exposed
/license.txt
Server error log exposed
/error_log
REST API user enumeration blocked
wp-cron.php is publicly accessible (potential DDoS vector)
/wp-cron.php
How to fix: Disable WP-Cron in wp-config.php with define("DISABLE_WP_CRON", true) and use a real server cron job instead.
Suspicious inline JavaScript: String.fromCharCode obfuscation
How to fix: Inspect this inline JavaScript carefully — obfuscated code can indicate malware injection.
Unknown external JavaScript from: optin.myperfit.com
How to fix: Review this script source. If it's legitimate (analytics, chat widget), no action needed. If unknown, investigate and remove.
3 trusted external script(s): js.hs-scripts.com (Email Marketing), www.google.com (Google), www.googletagmanager.com (Google)
Found 1 unknown external JS source(s): optin.myperfit.com
Checked against 11 blacklist services
Your site needs immediate attention
We found critical security issues. Our experts can clean your site and fix all vulnerabilities within 24 hours.
Get Expert Cleanup — $49