Domain Security Report: **********.com

Domain Information

WordPress Version: 7.1.2 HIGH 7 vulnerability matches

Detected theme deon

1.0· 100% conf.

Used by 74 domains

Last Checked: 2026-10-06 12:01:14

HTTPS: Yes

Server: nginx

Response time (TTFB): 6,092 ms slow

Hosting: IBM Cloud (AS36351)

IP address: 169.63.242.xxx

Plugins (12)

Versions are displayed when reliable observations are available.

Plugin	Version	Used By
contact-form-7	6.1.7· 85% conf.	1,782,498
deon-core	—	75
elementor	4.2.4· 85% conf.	1,675,067
elementor-addon-components	3.5.7· 85% conf.	535
menu-image	3.13· 60% conf.	21,326
page-scroll-to-id	1.7.9· 60% conf.	25,735
popup-maker	—	92,599
premium-addons-for-elementor	4.11.106· 60% conf.MEDIUM4 vulnerability matches	75,722
pro-elements	3.8.0· 85% conf.	64,239
qi-addons-for-elementor	1.11.1· 85% conf.	28,912
revslider	6.6.11· 85% conf.HIGH16 vulnerability matches	561,595
wpcf7-recaptcha	1.2· 60% conf.	9,696

Security Findings

These findings combine public scan observations with advisories matching detected software versions. Version matches do not establish exploitation.

WordPress core vulnerabilities

WordPress Core — 7 matching advisories (highest severity: High). Review relevant security updates for this WordPress branch.

View 7 matching WordPress core advisories

WordPress 7.1.2 — Vulnerability advisories

High 7 published advisories match this exact core release.

WordPress Core 7.1 - 7.1.2 - Unauthenticated Stored Cross-Site Scripting via Pending Comments
WordPress Core 4.7.0 - 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Imgur oEmbed
WordPress Core 4.7.0 - 7.1.2 - Unauthenticated Sensitive Information Exposure via Comment Feeds · CVE-2026-66666
WordPress Core 6.5.0 - 7.1.2 - Authenticated (Author+) Second-Order SQL Injection via WXR Export
WordPress Core 4.7.0 - 7.1.2 - Authenticated (Author+) Unauthorized Sticky Post Modification via REST API

Showing 5 of 7 matching advisories.

Vulnerability intelligence: Wordfence Intelligence. Observed component/version confidence is reported separately. A missing advisory match is not a guarantee of security.

Plugin & theme vulnerabilities

Plugin: premium-addons-for-elementor 4.11.106 — 4 matching advisories (highest severity: Medium). View advisories
Plugin: revslider 6.6.11 — 16 matching advisories (highest severity: High). View advisories

Other observed security findings

User enumeration exposed — Usernames are publicly discoverable via the REST API or author archives, aiding brute-force attacks ?

Need help securing your WordPress infrastructure? Contact us for a professional security audit.

Security Headers

Grade F

6 missing headers

Missing headers:

Strict-Transport-Security (HSTS) — Forces HTTPS connections ?
Content-Security-Policy (CSP) — Prevents XSS attacks ?
X-Content-Type-Options — Prevents MIME sniffing ?
X-Frame-Options — Prevents clickjacking ?
Referrer-Policy — Controls referrer information ?
Permissions-Policy — Limits browser features ?

Other WordPress domains on this IP (25+)

These WordPress domains are served from the same IP (169.63.242.xxx) — usually shared hosting or the same operator. Domains are obfuscated uniformly.

Show 17 more domains