Domain Security Report: ****************.com

Domain Information

WordPress Version: 6.9 CRITICAL 20 vulnerability matches

Detected theme intime

1.5.0· 100% conf.

Used by 161 domains

Last Checked: 2026-10-14 15:13:29

HTTPS: Yes

Server: Apache

Response time (TTFB): 585 ms

Hosting: Unified Layer (AS46606)

IP address: 162.251.85.xxx

Plugins (5)

Versions are displayed when reliable observations are available.

Plugin	Version	Used By
case-theme-core	1.0.0· 85% conf.	3,071
case-theme-user	1.0.0· 85% conf.CRITICAL2 vulnerability matches	1,961
elementor	3.33.2· 85% conf.MEDIUM10 vulnerability matches	1,675,067
elementor-pro	3.26.2· 85% conf.CRITICAL3 vulnerability matches	957,910
revslider	6.7.20· 85% conf.MEDIUM4 vulnerability matches	561,595

Security Findings

These findings combine public scan observations with advisories matching detected software versions. Version matches do not establish exploitation.

WordPress core vulnerabilities

WordPress Core — 20 matching advisories (highest severity: Critical). Review relevant security updates for this WordPress branch.

View 20 matching WordPress core advisories

WordPress 6.9 — Vulnerability advisories

Critical 20 published advisories match this exact core release.

WordPress Core 6.9 - 7.0.1 - Remote Code Execution via REST API Batch Request Route Confusion · CVE-2026-63030
WordPress Core <= 7.1.1 - Unauthenticated Local File Inclusion via locate_template() Path Traversal · CVE-2026-87902
WordPress Core 6.8 - 7.0.1 - Unauthenticated SQL Injection via author__not_in Parameter · CVE-2026-60137
WordPress Core <= 7.1 - Unauthenticated Stored Cross-Site Scripting via wpautop() Blockquote Handling · CVE-2026-93485
WordPress <= 6.9.1 - Authenticated (Author+) XML External Entity Injection via getID3 Library Media Upload

Showing 5 of 20 matching advisories.

Vulnerability intelligence: Wordfence Intelligence. Observed component/version confidence is reported separately. A missing advisory match is not a guarantee of security.

Plugin & theme vulnerabilities

Plugin: case-theme-user 1.0.0 — 2 matching advisories (highest severity: Critical). View advisories
Plugin: elementor 3.33.2 — 10 matching advisories (highest severity: Medium). View advisories
Plugin: elementor-pro 3.26.2 — 3 matching advisories (highest severity: Critical). View advisories
Plugin: revslider 6.7.20 — 4 matching advisories (highest severity: Medium). View advisories

Other observed security findings

User enumeration exposed — Usernames are publicly discoverable via the REST API or author archives, aiding brute-force attacks ?

Need help securing your WordPress infrastructure? Contact us for a professional security audit.

Security Headers

Grade F

6 missing headers

Missing headers:

Strict-Transport-Security (HSTS) — Forces HTTPS connections ?
Content-Security-Policy (CSP) — Prevents XSS attacks ?
X-Content-Type-Options — Prevents MIME sniffing ?
X-Frame-Options — Prevents clickjacking ?
Referrer-Policy — Controls referrer information ?
Permissions-Policy — Limits browser features ?

Other WordPress domains on this IP (11)

These WordPress domains are served from the same IP (162.251.85.xxx) — usually shared hosting or the same operator. Domains are obfuscated uniformly.

Show 3 more domains