Domain Security Report: ********.com

Domain Information

WordPress Version: 7.0 CRITICAL 14 vulnerability matches

Detected theme astra

4.11.13· 100% conf.HIGH2 vulnerability matches

Used by 407,822 domains

Last Checked: 2026-10-08 16:08:23

HTTPS: Yes

Server: cloudflare

CDN / WAF: Cloudflare

Response time (TTFB): 232 ms fast

Hosting: Cloudflare, Inc. (AS13335)

IP address: 188.114.97.xxx

Plugins (0)

Versions are displayed when reliable observations are available.

No plugins found.

Security Findings

These findings combine public scan observations with advisories matching detected software versions. Version matches do not establish exploitation.

WordPress core vulnerabilities

WordPress Core — 14 matching advisories (highest severity: Critical). Review relevant security updates for this WordPress branch.

View 14 matching WordPress core advisories

WordPress 7.0 — Vulnerability advisories

Critical 14 published advisories match this exact core release.

WordPress Core 6.9 - 7.0.1 - Remote Code Execution via REST API Batch Request Route Confusion · CVE-2026-63030
WordPress Core <= 7.1.1 - Unauthenticated Local File Inclusion via locate_template() Path Traversal · CVE-2026-87902
WordPress Core 6.8 - 7.0.1 - Unauthenticated SQL Injection via author__not_in Parameter · CVE-2026-60137
WordPress Core <= 7.1 - Unauthenticated Stored Cross-Site Scripting via wpautop() Blockquote Handling · CVE-2026-93485
WordPress Core <= 7.1 - Missing Authorization to customize_changeset Write via XML-RPC (Multisite/Custom Role edit_css Bypass)

Showing 5 of 14 matching advisories.

Vulnerability intelligence: Wordfence Intelligence. Observed component/version confidence is reported separately. A missing advisory match is not a guarantee of security.

Plugin & theme vulnerabilities

Theme: astra 4.11.13 — 2 matching advisories (highest severity: High). View advisories

Other observed security findings

User enumeration exposed — Usernames are publicly discoverable via the REST API or author archives, aiding brute-force attacks ?

Need help securing your WordPress infrastructure? Contact us for a professional security audit.

Security Headers

Grade F

6 missing headers

Missing headers:

Strict-Transport-Security (HSTS) — Forces HTTPS connections ?
Content-Security-Policy (CSP) — Prevents XSS attacks ?
X-Content-Type-Options — Prevents MIME sniffing ?
X-Frame-Options — Prevents clickjacking ?
Referrer-Policy — Controls referrer information ?
Permissions-Policy — Limits browser features ?

Other WordPress domains on this IP (25+)

These WordPress domains are served from the same IP (188.114.97.xxx) — usually shared hosting or the same operator. Domains are obfuscated uniformly.

Show 17 more domains