Security Scan Results
https://womeninsoccer.org
Scan complete
womeninsoccer.org
Poor — Multiple Issues Found
32 issues detected
Scanned 4 months ago
32
Total
0
Critical
0
High
21
Medium
Plugin 'sassy-social-share' v3.3.56: Sassy Social Share <= 3.3.56 - Authenticated (Contributor+) Stored Cross-Site Scripting
Plugin 'sassy-social-share' v3.3.56: Social Sharing Plugin – Sassy Social Share <= 3.3.69 - Reflected Cross-Site Scripting via heateor_mastodon_share Parameter
Plugin 'sassy-social-share' v3.3.56: Social Sharing Plugin – Sassy Social Share <= 3.3.75 - Reflected Cross-Site Scripting via 'heateor_mastodon_share' Parameter
Plugin 'sassy-social-share' v3.3.56: Sassy Social Share <= 3.3.62 - Authenticated (Administrator+) Stored Cross-Site Scripting
Plugin 'sassy-social-share' v3.3.56: Social Sharing Plugin – Sassy Social Share <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Plugin 'sassy-social-share' v3.3.56: Sassy Social Share <= 3.3.60 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Plugin 'sassy-social-share' v3.3.56: Sassy Social Share <= 3.3.73 - Open Redirect
Plugin 'wp-statistics' v6.9.1: WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.2.6
Plugin 'wp-statistics' v6.9.1: WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 9.5.2
Plugin 'wp-statistics' v6.9.1: WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 9.1.3
Plugin 'wp-statistics' v6.9.1: WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 8.3.1
Plugin 'wp-statistics' v6.9.1: WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 8.5
Plugin 'wp-statistics' v6.9.1: WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 12.6.7
Plugin 'wp-statistics' v6.9.1: WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.2.9
Plugin 'wp-statistics' v6.9.1: WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 12.0.9
Plugin 'wp-statistics' v6.9.1: WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 9.4.1
Plugin 'optinmonster' v2.15.1: Popup Builder by OptinMonster – WordPress Popups for Optins, Email Newsletters and Lead Generation <= 2.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Plugin 'optinmonster' v2.15.1: Popup Builder by OptinMonster – WordPress Popups for Optins, Email Newsletters and Lead Generation <= 2.15.3 - Cross-Site Request Forgery to Notice Dismissal
WP_DEBUG is disabled (no PHP errors visible)
Missing security header: X-Frame-Options -- Prevents clickjacking attacks
How to fix: Add to .htaccess: Header always set X-Frame-Options "SAMEORIGIN" — prevents clickjacking attacks.
Missing security header: X-Content-Type-Options -- Prevents MIME-type sniffing
How to fix: Add to .htaccess: Header always set X-Content-Type-Options "nosniff" — prevents MIME-type sniffing.
Missing security header: Strict-Transport-Security -- Enforces HTTPS connections
How to fix: Add to .htaccess or nginx: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Missing security header: Content-Security-Policy -- Controls resource loading
Missing security header: Referrer-Policy -- Controls referrer information
Missing security header: Permissions-Policy -- Controls browser feature access
SSL certificate valid (86 days remaining) — issued by Google Trust Services
HTTP correctly redirects to HTTPS
WordPress license file exposed
/license.txt
REST API user enumeration blocked
wp-cron.php is publicly accessible (potential DDoS vector)
/wp-cron.php
How to fix: Disable WP-Cron in wp-config.php with define("DISABLE_WP_CRON", true) and use a real server cron job instead.
3 trusted external script(s): cdnjs.cloudflare.com (CDN), unpkg.com (CDN), www.googletagmanager.com (Google)
Checked against 11 blacklist services
Your site needs immediate attention
We found critical security issues. Our experts can clean your site and fix all vulnerabilities within 24 hours.
Get Expert Cleanup — $49