Security Scan Results
https://projecthub.pl
Scan complete
projecthub.pl
Critical — Immediate Action Needed
36 issues detected
Scanned 2 weeks ago
36
Total
0
Critical
5
High
19
Medium
WordPress version 7.0.4 detected
Plugin 'elementor' v3.6.7: Elementor <= 3.18.1 - Authenticated(Contributor+) Arbitrary File Upload to Remote Code Execution via Template Import
Plugin 'elementor' v3.6.7: Elementor <= 3.19.0 - Authenticated(Contributor+) Arbitrary File Deletion and PHAR Deserialization
Plugin 'elementor' v3.6.7: Elementor <= 3.12.1 - Authenticated(Administrator+) SQL Injection via 'replace_urls'
Plugin 'elementor' v3.6.7: Elementor Website Builder <= 3.16.4 - Missing Authorization to Arbitrary Attachment Read
Plugin 'elementor' v3.6.7: Elementor Website Builder <= 3.16.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via get_inline_svg()
Plugin 'elementor-pro' v3.7.2: Elementor Pro <= 3.11.6 - Authenticated(Subscriber+) Privilege Escalation via update_page_option
Plugin 'elementor-pro' v3.7.2: Elementor Website Builder <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Plugin 'elementor-pro' v3.7.2: Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via video_html_tag
Plugin 'elementor-pro' v3.7.2: Elementor Website Builder Pro <= 3.20.1 - Authententicated (Contributor+) Stored Cross-Site Scripting
Plugin 'elementor-pro' v3.7.2: Elementor Website Builder Pro <= 3.21.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
Plugin 'elementor-pro' v3.7.2: Elementor Pro <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Plugin 'elementor-pro' v3.7.2: Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Widget SVGZ File Upload
Plugin 'elementor-pro' v3.7.2: Elementor Pro <= 3.13.0 - Missing Authorization
Plugin 'ultimate-elementor' v1.36.8: Ultimate Addons for Elementor <= 1.36.31 - Authenticated (Contributor+) Privilege Escalation
Plugin 'ultimate-elementor' v1.36.8: Ultimate Addons for Elementor <= 1.36.20 - Authenticated (Contributor+) Privilege Escalation
Plugin 'ultimate-elementor' v1.36.8: Ultimate Addons for Elementor <= 1.45.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Theme 'astra' v3.9.0: Astra WordPress Theme - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta vulnerability
Theme 'astra' v3.9.0: Astra <= 4.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display Name
Theme 'astra' v3.9.0: Astra <= 4.12.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta
Theme 'astra' v3.9.0: Astra <= 4.6.4 - Authenticated (Editor+) Stored Cross-Site Scripting via Theme Header/Footer
WP_DEBUG is disabled (no PHP errors visible)
Missing security header: X-Frame-Options -- Prevents clickjacking attacks
How to fix: Add to .htaccess: Header always set X-Frame-Options "SAMEORIGIN" — prevents clickjacking attacks.
Missing security header: X-Content-Type-Options -- Prevents MIME-type sniffing
How to fix: Add to .htaccess: Header always set X-Content-Type-Options "nosniff" — prevents MIME-type sniffing.
Missing security header: Strict-Transport-Security -- Enforces HTTPS connections
How to fix: Add to .htaccess or nginx: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Missing security header: Content-Security-Policy -- Controls resource loading
Missing security header: Referrer-Policy -- Controls referrer information
Missing security header: Permissions-Policy -- Controls browser feature access
SSL certificate valid (56 days remaining) — issued by home.pl S.A.
HTTP correctly redirects to HTTPS
WordPress readme exposed (version info)
/readme.html
WordPress license file exposed
/license.txt
User enumeration possible via REST API -- found: admin, wojciech_gilewski
How to fix: Disable the REST API users endpoint with a plugin like Disable REST API or add a filter to block /wp/v2/users.
wp-cron.php is publicly accessible (potential DDoS vector)
/wp-cron.php
How to fix: Disable WP-Cron in wp-config.php with define("DISABLE_WP_CRON", true) and use a real server cron job instead.
1 trusted external script(s): stats.wp.com (WordPress)
Checked against 11 blacklist services
Your site needs immediate attention
We found critical security issues. Our experts can clean your site and fix all vulnerabilities within 24 hours.
Get Expert Cleanup — $49