Security Scan Results
https://wpkurzus.hu
Scan complete
wpkurzus.hu
Critical — Immediate Action Needed
36 issues detected
Scanned 4 months ago
36
Total
0
Critical
0
High
22
Medium
WordPress version 6.9.1 detected
Plugin 'activecampaign-subscription-forms' v6.9.1: ActiveCampaign – Forms, Site Tracking, Live Chat <= 8.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
Plugin 'activecampaign-subscription-forms' v6.9.1: ActiveCampaign <= 8.1.14 - Authenticated (Administrator+) Server-Side Request Forgery
Plugin 'activecampaign-subscription-forms' v6.9.1: ActiveCampaign <= 8.1.16 - Authenticated (Administrator+) Stored Cross-Site Scripting
Plugin 'activecampaign-subscription-forms' v6.9.1: ActiveCampaign < 8.0.2 - Cross-Site Request Forgery
Plugin 'activecampaign-subscription-forms' v6.9.1: ActiveCampaign < 8.0.2 - Cross-Site Request Forgery in Settings
Plugin 'activecampaign-subscription-forms' v6.9.1: ActiveCampaign < 8.1.12 - Contributor+ Stored XSS
Plugin 'activecampaign-subscription-forms' v6.9.1: ActiveCampaign < 8.1.15 - Authenticated (Administrator+) Server-Side Request Forgery
Plugin 'activecampaign-subscription-forms' v6.9.1: ActiveCampaign < 8.1.17 - Authenticated (Administrator+) Stored Cross-Site Scripting
Plugin 'elementor' v0.2.1: Elementor < 3.1.4 - Authenticated Stored Cross-Site Scripting (XSS) in Image Box Widget
Plugin 'elementor' v0.2.1: Elementor < 3.1.4 - Authenticated Stored Cross-Site Scripting (XSS) in Column Element
Plugin 'elementor' v0.2.1: Elementor < 3.1.4 - Authenticated Stored Cross-Site Scripting (XSS) in Heading Widget
Plugin 'elementor' v0.2.1: Elementor < 3.1.4 - Authenticated Stored Cross-Site Scripting (XSS) in Divider Widget
Plugin 'elementor' v0.2.1: Elementor < 3.1.4 - Authenticated Stored Cross-Site Scripting (XSS) in Accordion Widget
Plugin 'elementor' v0.2.1: Elementor < 3.1.4 - Authenticated Stored Cross-Site Scripting (XSS) in Icon Box Widget
Plugin 'elementor' v0.2.1: Elementor Website Builder < 3.12.2 - Admin+ SQLi
Plugin 'elementor' v0.2.1: Elementor < 3.5.6 - DOM Reflected Cross-Site Scripting
Plugin 'elementor' v0.2.1: Elementor Page Builder < 2.8.4 - Cross-Site Scripting (XSS)
WP_DEBUG is disabled (no PHP errors visible)
Missing security header: X-Frame-Options -- Prevents clickjacking attacks
How to fix: Add to .htaccess: Header always set X-Frame-Options "SAMEORIGIN" — prevents clickjacking attacks.
Missing security header: X-Content-Type-Options -- Prevents MIME-type sniffing
How to fix: Add to .htaccess: Header always set X-Content-Type-Options "nosniff" — prevents MIME-type sniffing.
Missing security header: Content-Security-Policy -- Controls resource loading
Missing security header: Referrer-Policy -- Controls referrer information
Missing security header: Permissions-Policy -- Controls browser feature access
1 of 6 security headers configured
SSL certificate valid (54 days remaining) — issued by Google Trust Services
HTTP correctly redirects to HTTPS
All cookies have Secure, HttpOnly, and SameSite flags
WordPress readme exposed (version info)
/readme.html
WordPress license file exposed
/license.txt
User enumeration possible via REST API -- found: ani, polla, daniel-toth, adam-kiszervezett, egyed
How to fix: Disable the REST API users endpoint with a plugin like Disable REST API or add a filter to block /wp/v2/users.
wp-cron.php is publicly accessible (potential DDoS vector)
/wp-cron.php
How to fix: Disable WP-Cron in wp-config.php with define("DISABLE_WP_CRON", true) and use a real server cron job instead.
Suspicious inline JavaScript: unicode-escaped strings
How to fix: Inspect this inline JavaScript carefully — obfuscated code can indicate malware injection.
Suspicious inline JavaScript: unicode-escaped strings
How to fix: Inspect this inline JavaScript carefully — obfuscated code can indicate malware injection.
No external scripts detected
Checked against 11 blacklist services
Your site needs immediate attention
We found critical security issues. Our experts can clean your site and fix all vulnerabilities within 24 hours.
Get Expert Cleanup — $49