Security Scan Results
https://jbclinic.pl
Scan complete
jbclinic.pl
Critical — Immediate Action Needed
47 issues detected
Scanned 2 weeks ago
47
Total
2
Critical
8
High
22
Medium
WordPress 4.9.16: WordPress Core < 6.0.3 - SQL Injection via WP_Date_Query
WordPress 4.9.16: WordPress Core < 5.5.3 - PHP Object Injection Gadget
WordPress version 4.9.16 detected
Plugin 'contact-form-7' v5.0.4: Contact Form 7 <= 5.3.1 - Arbitrary File Upload via Bypass
Plugin 'contact-form-7' v5.0.4: Contact Form 7 <= 5.8.3 - Authenticated (Editor+) Arbitrary File Upload
Plugin 'contact-form-7' v5.0.4: Contact Form 7 <= 5.0.3 - Authorization Bypass
Plugin 'contact-form-7' v5.0.4: Contact Form 7 <= 5.9.4 - Unauthenticated Open Redirect
Plugin 'contact-form-7' v5.0.4: Contact Form 7 <= 5.9 - Reflected Cross-Site Scripting
Plugin 'contact-form-7' v5.0.4: Contact Form 7 <= 6.0.5 - Order Replay Vulnerability
Plugin 'contact-form-7' v5.0.4: Contact Form 7 [contact-form-7] < 5.0.4
Plugin 'contact-form-7' v5.0.4: Contact Form 7 [contact-form-7] < 5.3.2
Plugin 'revslider' v5.3.0.2: Slider Revolution < 6.6.19 - Authenticated (Author+) PHP Object Injection
Plugin 'revslider' v5.3.0.2: Slider Revolution <= 6.6.15 - Authenticated (Author+) Arbitrary File Upload
Plugin 'revslider' v5.3.0.2: Slider Revolution <= 6.6.12 - Authenticated (Administrator+) Arbitrary File Upload
Plugin 'revslider' v5.3.0.2: Slider Revolution <= 6.7.36 - Authenticated (Contributor+) Arbitrary File Read via 'used_svg' and 'used_images'
Plugin 'revslider' v5.3.0.2: Slider Revolution <= 6.7.37 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Read
Plugin 'js_composer' v5.0.1: WPBakery <= 7.7 - Authenticated (Author+) Local File Inclusion
Plugin 'js_composer' v5.0.1: WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Heading tag attribute
Plugin 'js_composer' v5.0.1: WPBakery Page Builder <= 8.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Page Builder Elements
Plugin 'js_composer' v5.0.1: WPBakery Page Builder for WordPress <= 8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Plugin 'js_composer' v5.0.1: WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Author
Plugin 'js_composer' v5.0.1: WPBakery Page Builder <= 8.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via Grid Builder
Plugin 'js_composer' v5.0.1: WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button onclick attribute
Plugin 'js_composer' v5.0.1: WPBakery Page Builder for WordPress <= 6.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Plugin 'js_composer' v5.0.1: WPBakery <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting
Plugin 'google-analytics-for-wordpress' v7.10.0: MonsterInsights <= 10.1.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure And Plugin Integration Reset
Plugin 'google-analytics-for-wordpress' v7.10.0: Google Analytics by Monster Insights <= 8.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Plugin 'google-analytics-for-wordpress' v7.10.0: MonsterInsights <= 8.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Plugin 'google-analytics-for-wordpress' v7.10.0: MonsterInsights <= 8.9.0 - Unauthenticated Stored Cross-Site Scripting via Google Analytics
Plugin 'google-analytics-for-wordpress' v7.10.0: Google Analytics by Monster Insights <= 8.21.0 - Missing Authorization
Plugin 'woocommerce' v4.8.0: WooCommerce < 5.5 - Authenticated Blind SQL Injection
Plugin 'woocommerce' v4.8.0: WooCommerce <= 6.2.0 - Path Traversal via Tax Importer
WP_DEBUG is disabled (no PHP errors visible)
Missing security header: X-Frame-Options -- Prevents clickjacking attacks
How to fix: Add to .htaccess: Header always set X-Frame-Options "SAMEORIGIN" — prevents clickjacking attacks.
Missing security header: X-Content-Type-Options -- Prevents MIME-type sniffing
How to fix: Add to .htaccess: Header always set X-Content-Type-Options "nosniff" — prevents MIME-type sniffing.
Missing security header: Strict-Transport-Security -- Enforces HTTPS connections
How to fix: Add to .htaccess or nginx: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Missing security header: Content-Security-Policy -- Controls resource loading
Missing security header: Referrer-Policy -- Controls referrer information
Missing security header: Permissions-Policy -- Controls browser feature access
SSL certificate valid (32 days remaining) — issued by Let's Encrypt
HTTP correctly redirects to HTTPS
WordPress readme exposed (version info)
/readme.html
WordPress license file exposed
/license.txt
REST API user enumeration blocked
wp-cron.php is publicly accessible (potential DDoS vector)
/wp-cron.php
How to fix: Disable WP-Cron in wp-config.php with define("DISABLE_WP_CRON", true) and use a real server cron job instead.
2 trusted external script(s): maps.googleapis.com (Google), www.google.com (Google)
Checked against 11 blacklist services
Your site needs immediate attention
We found critical security issues. Our experts can clean your site and fix all vulnerabilities within 24 hours.
Get Expert Cleanup — $49