Security Scan Results
https://ncpwd.go.ke
Scan complete
ncpwd.go.ke
Critical — Immediate Action Needed
48 issues detected
Scanned 4 months ago
48
Total
0
Critical
0
High
36
Medium
WordPress version 6.9.4 detected
Plugin 'jet-menu' v2.4.7.1: JetMenu <= 2.4.11.1 - Authenticated (Subscriber+) Information Exposure
Plugin 'jet-menu' v2.4.7.1: JetMenu <= 2.4.9 - Missing Authorization
Plugin 'jet-engine' v3.6.2: JetEngine [jet-engine] < 3.7.1.1
Plugin 'jet-engine' v3.6.2: JetEngine [jet-engine] < 3.6.3
Plugin 'jet-engine' v3.6.2: JetEngine [jet-engine] < 3.6.5
Plugin 'jet-engine' v3.6.2: JetEngine [jet-engine] <= 3.7.7 (unfixed)
Plugin 'jet-engine' v3.6.2: JetEngine [jet-engine] <= 3.8.1.1 (unfixed)
Plugin 'elementor' v0.2.1: Elementor Website Builder – More Than Just a Page Builder [elementor] < 2.9.10 (closed)
Plugin 'elementor' v0.2.1: Elementor Website Builder – More Than Just a Page Builder [elementor] < 3.1.4 (closed)
Plugin 'elementor' v0.2.1: Elementor Website Builder – More Than Just a Page Builder [elementor] < 3.1.4 (closed)
Plugin 'elementor' v0.2.1: Elementor Website Builder – More Than Just a Page Builder [elementor] < 3.1.4 (closed)
Plugin 'elementor' v0.2.1: Elementor Website Builder – More Than Just a Page Builder [elementor] < 3.0.14 (closed)
Plugin 'elementor' v0.2.1: Elementor Website Builder – More Than Just a Page Builder [elementor] < 2.9.3 (closed)
Plugin 'elementor' v0.2.1: Elementor Website Builder – More Than Just a Page Builder [elementor] < 2.9.14 (closed)
Plugin 'elementor' v0.2.1: Elementor Website Builder – More Than Just a Page Builder [elementor] < 2.9.6 (closed)
Plugin 'elementor' v0.2.1: Elementor Website Builder – More Than Just a Page Builder [elementor] < 2.9.9 (closed)
Plugin 'elementor' v0.2.1: Elementor Website Builder – More Than Just a Page Builder [elementor] < 1.8.0 (closed)
Plugin 'jet-tabs' v2.2.6.2: JetTabs <= 2.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Plugin 'jet-tabs' v2.2.6.2: JetTabs <= 2.2.12 - Missing Authorization
Plugin 'jet-tabs' v2.2.6.2: JetTabs <= 2.2.9 - Authenticated (Subscriber+) Information Exposure
Plugin 'jet-tabs' v2.2.6.2: JetTabs <= 2.2.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
Plugin 'jet-tabs' v2.2.6.2: JetTabs <= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Plugin 'jet-tabs' v2.2.6.2: JetTabs <= 2.2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Plugin 'elementskit' v3.7.5: ElementsKit Pro <= 3.7.8 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via url Parameter
Plugin 'jet-blocks' v1.3.16: JetBlocks For Elementor <= 1.3.18 - Authenticated (Subscriber+) Information Disclsoure
Plugin 'jet-blocks' v1.3.16: JetBlocks For Elementor <= 1.3.16 - Authenticated (Contributor+) Stored Cross-Site Scripting
Plugin 'jet-blocks' v1.3.16: JetBlocks For Elementor <= 1.3.19 - Authenticated (Contributor+) Stored Cross-Site Scripting
Plugin 'jet-blocks' v1.3.16: JetBlocks For Elementor <= 1.3.16 - Missing Authorization
Plugin 'jet-blocks' v1.3.16: JetBlocks For Elementor <= 1.3.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
Theme 'astra' v4.3.1: Astra WordPress Theme - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta vulnerability
Theme 'astra' v4.3.1: Astra <= 4.6.4 - Authenticated (Editor+) Stored Cross-Site Scripting via Theme Header/Footer
Theme 'astra' v4.3.1: Astra <= 4.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display Name
WP_DEBUG is disabled (no PHP errors visible)
Missing security header: X-Frame-Options -- Prevents clickjacking attacks
How to fix: Add to .htaccess: Header always set X-Frame-Options "SAMEORIGIN" — prevents clickjacking attacks.
Missing security header: X-Content-Type-Options -- Prevents MIME-type sniffing
How to fix: Add to .htaccess: Header always set X-Content-Type-Options "nosniff" — prevents MIME-type sniffing.
Missing security header: Strict-Transport-Security -- Enforces HTTPS connections
How to fix: Add to .htaccess or nginx: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Missing security header: Content-Security-Policy -- Controls resource loading
Missing security header: Referrer-Policy -- Controls referrer information
Missing security header: Permissions-Policy -- Controls browser feature access
SSL certificate valid (44 days remaining) — issued by Google Trust Services
HTTP does not redirect to HTTPS
How to fix: Add a redirect rule in .htaccess or your host's SSL settings to force HTTP → HTTPS.
All cookies have Secure, HttpOnly, and SameSite flags
WordPress readme exposed (version info)
/readme.html
WordPress license file exposed
/license.txt
REST API user enumeration blocked
No external scripts detected
Checked against 11 blacklist services
Your site needs immediate attention
We found critical security issues. Our experts can clean your site and fix all vulnerabilities within 24 hours.
Get Expert Cleanup — $49