https://zimnat.co.zw
Scan complete
35 issues detected
Scanned 1 week ago
35
Total
0
Critical
8
High
15
Medium
WordPress version 7.0 detected
Plugin 'click-to-chat-for-whatsapp' v3.28: Click to Chat – HoliThemes <= 3.35 - Authenticated (Contributor+) Local File Inclusion
Plugin 'click-to-chat-for-whatsapp' v3.28: Click to Chat <= 4.22 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via data-no_number Parameter
Plugin 'click-to-chat-for-whatsapp' v3.28: Click to Chat <= 4.39 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'num' Shortcode Parameter
Plugin 'click-to-chat-for-whatsapp' v3.28: Click to Chat – HoliThemes [click-to-chat-for-whatsapp] < 4.0
Plugin 'click-to-chat-for-whatsapp' v3.28: Click to Chat – HoliThemes [click-to-chat-for-whatsapp] < 4.23
Plugin 'contact-form-7' v5.7.7: Contact Form 7 <= 5.8.3 - Authenticated (Editor+) Arbitrary File Upload
Plugin 'contact-form-7' v5.7.7: Contact Form 7 <= 5.9.4 - Unauthenticated Open Redirect
Plugin 'contact-form-7' v5.7.7: Contact Form 7 <= 5.9 - Reflected Cross-Site Scripting
Plugin 'contact-form-7' v5.7.7: Contact Form 7 <= 6.0.5 - Order Replay Vulnerability
Plugin 'revslider' v6.6.10: Slider Revolution < 6.6.19 - Authenticated (Author+) PHP Object Injection
Plugin 'revslider' v6.6.10: Slider Revolution <= 6.6.15 - Authenticated (Author+) Arbitrary File Upload
Plugin 'revslider' v6.6.10: Slider Revolution <= 6.6.12 - Authenticated (Administrator+) Arbitrary File Upload
Plugin 'revslider' v6.6.10: Slider Revolution <= 6.7.36 - Authenticated (Contributor+) Arbitrary File Read via 'used_svg' and 'used_images'
Plugin 'revslider' v6.6.10: Slider Revolution <= 6.7.37 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Read
Plugin 'download-monitor' v4.8.3: Download Monitor <= 4.8.3 - Authenticated(Subscriber+) Arbitrary File Upload via upload_file
Plugin 'download-monitor' v4.8.3: Download Monitor <= 5.0.22 - Authenticated (Contributor+) Local File Inclusion
Plugin 'download-monitor' v4.8.3: Download Monitor <= 5.1.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Order Completion via 'token' and 'order_id'
Plugin 'download-monitor' v4.8.3: Download Monitor <= 4.9.4 - Authenticated (Admin+) SQL Injection
Plugin 'mailchimp-for-wp' v4.9.4: MC4WP: Mailchimp for WordPress <= 4.11.1 - Missing Authorization to Unauthenticated Arbitrary Subscription Deletion
Plugin 'mailchimp-for-wp' v4.9.4: MC4WP - Missing Authorization to Unauthenticated Arbitrary Subscription Deletion vulnerability
Plugin 'wpforms' v1.8.2: WPForms Pro [wpforms] < 1.8.5.4
WP_DEBUG is disabled (no PHP errors visible)
Missing security header: X-Frame-Options -- Prevents clickjacking attacks
How to fix: Add to .htaccess: Header always set X-Frame-Options "SAMEORIGIN" — prevents clickjacking attacks.
Missing security header: X-Content-Type-Options -- Prevents MIME-type sniffing
How to fix: Add to .htaccess: Header always set X-Content-Type-Options "nosniff" — prevents MIME-type sniffing.
Missing security header: Strict-Transport-Security -- Enforces HTTPS connections
How to fix: Add to .htaccess or nginx: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Missing security header: Content-Security-Policy -- Controls resource loading
Missing security header: Referrer-Policy -- Controls referrer information
Missing security header: Permissions-Policy -- Controls browser feature access
SSL certificate valid (130 days remaining) — issued by DigiCert Inc
HTTP correctly redirects to HTTPS
Unknown external JavaScript from: tt.mbww.com
How to fix: Review this script source. If it's legitimate (analytics, chat widget), no action needed. If unknown, investigate and remove.
1 trusted external script(s): www.googletagmanager.com (Google)
Found 1 unknown external JS source(s): tt.mbww.com
Checked against 11 blacklist services
We found critical security issues. Our experts can clean your site and fix all vulnerabilities within 24 hours.
Get Expert Cleanup — $49