Security Scan Results

Plugin 'jeg-elementor-kit' v1.3.0: Jeg Elementor Kit <= 2.5.6 - Unauthenticated Authorization Bypass

Plugin 'jeg-elementor-kit' v1.3.0: Jeg Elementor Kit <= 2.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Button and Countdown Widgets

Plugin 'jeg-elementor-kit' v1.3.0: Jeg Elementor Kit <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial

Plugin 'jeg-elementor-kit' v1.3.0: Jeg Elementor Kit <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags

Plugin 'jeg-elementor-kit' v1.3.0: Jeg Elementor Kit <= 2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Tabs and JKit - Accordion Widgets

Plugin 'jeg-elementor-kit' v1.3.0: Jeg Elementor Kit <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Countdown Widget

Plugin 'jeg-elementor-kit' v1.3.0: Jeg Elementor Kit <= 2.6.4 - Authenticated (Contributor+) Cross-Site Scripting via Elementor Widget URL Custom Attributes

Plugin 'jeg-elementor-kit' v1.3.0: Jeg Elementor Kit <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget

Plugin 'jeg-elementor-kit' v1.3.0: Jeg Elementor Kit <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget

Plugin 'jeg-elementor-kit' v1.3.0: Jeg Kit for Elementor <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg_content_number_prefix' Shortcode Attribute

Plugin 'wpdatatables' v6.5.1.1: wpDataTables (Premium) <= 7.4 - Unauthenticated SQL Injection

Plugin 'wpdatatables' v6.5.1.1: wpDataTables (Premium) <= 7.3.6 - Unauthenticated SQL Injection

Plugin 'elementor-pro' v3.27.0: Elementor Website Builder <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Plugin 'elementor-pro' v3.27.0: Elementor Pro <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

WP_DEBUG is disabled (no PHP errors visible)

Missing security header: X-Frame-Options -- Prevents clickjacking attacks

How to fix: Add to .htaccess: Header always set X-Frame-Options "SAMEORIGIN" — prevents clickjacking attacks.

Missing security header: X-Content-Type-Options -- Prevents MIME-type sniffing

How to fix: Add to .htaccess: Header always set X-Content-Type-Options "nosniff" — prevents MIME-type sniffing.

Missing security header: Strict-Transport-Security -- Enforces HTTPS connections

How to fix: Add to .htaccess or nginx: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

Missing security header: Content-Security-Policy -- Controls resource loading

Missing security header: Referrer-Policy -- Controls referrer information

Missing security header: Permissions-Policy -- Controls browser feature access

SSL certificate valid (76 days remaining) — issued by Let's Encrypt

HTTP correctly redirects to HTTPS

WordPress readme exposed (version info)

/readme.html

WordPress license file exposed

/license.txt

REST API user enumeration blocked

wp-cron.php is publicly accessible (potential DDoS vector)

/wp-cron.php

How to fix: Disable WP-Cron in wp-config.php with define("DISABLE_WP_CRON", true) and use a real server cron job instead.

1 trusted external script(s): www.googletagmanager.com (Google)