Domain Security Report: ****************.com

Domain Information

WordPress Version: 6.3.12 HIGH 15 vulnerability matches

Detected theme system-p-template

Used by 205 domains

Last Checked: 2026-09-25 07:08:15

HTTPS: Yes

Server: nginx

Response time (TTFB): 1,786 ms slow

Hosting: Xserver Inc. (AS131965)

IP address: 162.43.122.xxx

Plugins (0)

Versions are displayed when reliable observations are available.

No plugins found.

Security Findings

These findings combine public scan observations with advisories matching detected software versions. Version matches do not establish exploitation.

WordPress core vulnerabilities

WordPress Core — 15 matching advisories (highest severity: High). Review relevant security updates for this WordPress branch.

View 15 matching WordPress core advisories

WordPress 6.3.12 — Vulnerability advisories

High 15 published advisories match this exact core release.

WordPress Core <= 7.1 - Unauthenticated Stored Cross-Site Scripting via wpautop() Blockquote Handling · CVE-2026-93485
WordPress Core 4.7.0 - 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Imgur oEmbed
WordPress Core <= 7.1 - Missing Authorization to customize_changeset Write via XML-RPC (Multisite/Custom Role edit_css Bypass)
WordPress Core 4.7.0 - 7.1.2 - Unauthenticated Sensitive Information Exposure via Comment Feeds · CVE-2026-66666
WordPress Core <= 7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom Header Image Data

Showing 5 of 15 matching advisories.

Vulnerability intelligence: Wordfence Intelligence. Observed component/version confidence is reported separately. A missing advisory match is not a guarantee of security.

Other observed security findings

User enumeration exposed — Usernames are publicly discoverable via the REST API or author archives, aiding brute-force attacks ?

Need help securing your WordPress infrastructure? Contact us for a professional security audit.

Security Headers

Grade F

6 missing headers

Missing headers:

Strict-Transport-Security (HSTS) — Forces HTTPS connections ?
Content-Security-Policy (CSP) — Prevents XSS attacks ?
X-Content-Type-Options — Prevents MIME sniffing ?
X-Frame-Options — Prevents clickjacking ?
Referrer-Policy — Controls referrer information ?
Permissions-Policy — Limits browser features ?

Other WordPress domains on this IP (25+)

These WordPress domains are served from the same IP (162.43.122.xxx) — usually shared hosting or the same operator. Domains are obfuscated uniformly.

Show 17 more domains