Security Scan Results
https://magik.pl
Scan complete
magik.pl
Critical — Immediate Action Needed
53 issues detected
Scanned 1 month ago
53
Total
2
Critical
7
High
27
Medium
WordPress version 5.4.20 detected
Plugin 'animated-typing-effect' v1: Typing Effect <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Plugin 'contact-form-7' v5.1.7: Contact Form 7 <= 5.3.1 - Arbitrary File Upload via Bypass
Plugin 'contact-form-7' v5.1.7: Contact Form 7 <= 5.8.3 - Authenticated (Editor+) Arbitrary File Upload
Plugin 'contact-form-7' v5.1.7: Contact Form 7 <= 5.9.4 - Unauthenticated Open Redirect
Plugin 'contact-form-7' v5.1.7: Contact Form 7 <= 5.9 - Reflected Cross-Site Scripting
Plugin 'contact-form-7' v5.1.7: Contact Form 7 <= 6.0.5 - Order Replay Vulnerability
Plugin 'contact-form-7' v5.1.7: Contact Form 7 [contact-form-7] < 5.3.2
Plugin '3d-flipbook-dflip-lite' v2.3.42: Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer <= 2.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting
Plugin '3d-flipbook-dflip-lite' v2.3.42: Dear Flipbook <= 2.4.20 - Authenticated (Auhtor+) Stored Cross-Site Scripting via PDF Page Labels
Plugin '3d-flipbook-dflip-lite' v2.3.42: Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer <= 2.3.65 - DOM-Based Reflected Cross-Site Scripting via 'pdf-source'
Plugin '3d-flipbook-dflip-lite' v2.3.42: DearFlip - Authenticated (Author+) Stored Cross-Site Scripting via PDF Page Labels vulnerability
Plugin '3d-flipbook-dflip-lite' v2.3.42: DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer <= 2.4.29 - Missing Authorization
Plugin 'js_composer' v6.1: WPBakery <= 7.7 - Authenticated (Author+) Local File Inclusion
Plugin 'js_composer' v6.1: WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Heading tag attribute
Plugin 'js_composer' v6.1: WPBakery Page Builder <= 8.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Page Builder Elements
Plugin 'js_composer' v6.1: WPBakery Page Builder for WordPress <= 8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Plugin 'js_composer' v6.1: WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Author
Plugin 'js_composer' v6.1: WPBakery Page Builder <= 8.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via Grid Builder
Plugin 'js_composer' v6.1: WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button onclick attribute
Plugin 'js_composer' v6.1: WPBakery Page Builder for WordPress <= 6.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Plugin 'js_composer' v6.1: WPBakery <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting
Plugin 'porto-functionality' v1.6.0: Porto Theme - Functionality <= 2.11.1 - Unauthenticated SQL Injection
Plugin 'porto-functionality' v1.6.0: Porto Theme - Functionality <= 3.0.9 - Authenticated (Contributor+) Local File Inclusion via Post Meta
Plugin 'porto-functionality' v1.6.0: Porto Theme - Functionality <= 3.1.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode
Plugin 'porto-functionality' v1.6.0: Porto Theme - Functionality < 3.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Plugin 'porto-functionality' v1.6.0: Porto Theme - Functionality <= 2.11.1 - Missing Authorization
Plugin 'porto-functionality' v1.6.0: Porto Theme - Functionality < 3.7.3 - Missing Authorization
Plugin 'porto-functionality' v1.6.0: Porto Functionality [porto-functionality] < 2.12.1
Plugin 'porto-functionality' v1.6.0: Porto Functionality [porto-functionality] < 2.12.1
Plugin 'porto-functionality' v1.6.0: Porto Functionality [porto-functionality] < 3.1.0
Plugin 'porto-functionality' v1.6.0: Porto Functionality [porto-functionality] < 3.1.1
Theme 'porto' v5.3.0: Porto <= 7.1.0 - Unauthenticated Local File Inclusion via porto_ajax_posts
Theme 'porto' v5.3.0: Porto <= 7.1.0 - Authenticated (Contributor+) Local File Inclusion via Post Meta
Theme 'porto' v5.3.0: Porto - Reflected Cross Site Scripting (XSS) vulnerability
Theme 'porto' v5.3.0: Porto <= 7.6.2 - Reflected Cross-Site Scripting
WP_DEBUG is disabled (no PHP errors visible)
Missing security header: X-Frame-Options -- Prevents clickjacking attacks
How to fix: Add to .htaccess: Header always set X-Frame-Options "SAMEORIGIN" — prevents clickjacking attacks.
Missing security header: X-Content-Type-Options -- Prevents MIME-type sniffing
How to fix: Add to .htaccess: Header always set X-Content-Type-Options "nosniff" — prevents MIME-type sniffing.
Missing security header: Strict-Transport-Security -- Enforces HTTPS connections
How to fix: Add to .htaccess or nginx: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Missing security header: Content-Security-Policy -- Controls resource loading
Missing security header: Referrer-Policy -- Controls referrer information
Missing security header: Permissions-Policy -- Controls browser feature access
SSL certificate valid (127 days remaining) — issued by Sectigo Limited
HTTP correctly redirects to HTTPS
WordPress readme exposed (version info)
/readme.html
WordPress license file exposed
/license.txt
PHP info page exposed
/info.php
User enumeration possible via REST API -- found: adminagro
How to fix: Disable the REST API users endpoint with a plugin like Disable REST API or add a filter to block /wp/v2/users.
wp-cron.php is publicly accessible (potential DDoS vector)
/wp-cron.php
How to fix: Disable WP-Cron in wp-config.php with define("DISABLE_WP_CRON", true) and use a real server cron job instead.
Suspicious inline JavaScript: String.fromCharCode obfuscation
How to fix: Inspect this inline JavaScript carefully — obfuscated code can indicate malware injection.
No external scripts detected
Checked against 11 blacklist services
Your site needs immediate attention
We found critical security issues. Our experts can clean your site and fix all vulnerabilities within 24 hours.
Get Expert Cleanup — $49