WordPress maintenance or security needs? Reach out!
TLDWP

Domain Security Report for *******.com

Publicly observed software, infrastructure, and security signals Last checked: 2026-09-18 07:32:01

Domain Information

WordPress Version: 7.1 HIGH 12 vulnerability matches

Detected theme Divi
4.27.8· 60% conf.
Used by 453,930 domains

Last Checked: 2026-09-18 07:32:01

HTTPS: Yes

Server: Apache

CDN / WAF: CloudFront

Response time (TTFB): 200 ms fast

Hosting: Amazon.com, Inc. (AS16509)

IP address: 18.239.83.xxx

Plugins (5)

Versions are displayed when reliable observations are available.

Plugin Version Used By
custom-twitter-feeds 2.9.0· 85% conf. 31,919
elementor — 1,675,067
handl-utm-grabber — 3,591
popup-maker — 92,599
wp-live-chat-software-for-wordpress 5.0.12· 85% conf. 2,606

Security Findings

These findings combine public scan observations with advisories matching detected software versions. Version matches do not establish exploitation.

WordPress core vulnerabilities

  • WordPress Core — 12 matching advisories (highest severity: High). Review relevant security updates for this WordPress branch.
View 12 matching WordPress core advisories

WordPress 7.1 — Vulnerability advisories

High 12 published advisories match this exact core release.

  • WordPress Core <= 7.1.1 - Unauthenticated Local File Inclusion via locate_template() Path Traversal · CVE-2026-87902
  • WordPress Core <= 7.1 - Unauthenticated Stored Cross-Site Scripting via wpautop() Blockquote Handling · CVE-2026-93485
  • WordPress Core <= 7.1 - Missing Authorization to customize_changeset Write via XML-RPC (Multisite/Custom Role edit_css Bypass)
  • WordPress Core <= 7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom Header Image Data
  • WordPress Core <= 7.1 - Authenticated (Contributor+) Path Traversal via REST Templates Controller

Showing 5 of 12 matching advisories.

Vulnerability intelligence: Wordfence Intelligence. Observed component/version confidence is reported separately. A missing advisory match is not a guarantee of security.

Other observed security findings

  • User enumeration exposed — Usernames are publicly discoverable via the REST API or author archives, aiding brute-force attacks ?

Need help securing your WordPress infrastructure? Contact us for a professional security audit.

Security Headers

A
Grade A

All headers present

All security headers are present.

Other WordPress domains on this IP (11)

These WordPress domains are served from the same IP (18.239.83.xxx) — usually shared hosting or the same operator. Domains are obfuscated uniformly.

Show 3 more domains
Copyright 2026, tldwp.com. All rights reserved. Data Use License · WordPress maintenance or security needs? Reach out!
WordPress is a trademark of the WordPress Foundation. TLDWP is an independent project and is not affiliated with or endorsed by the WordPress Foundation or the WordPress open source project.