_______________________________________________________________
        __          _______   _____
        \ \        / /  __ \ / ____|
         \ \  /\  / /| |__) | (___   ___  __ _ _ __
          \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \
           \  /\  /  | |     ____) | (__| (_| | | | |
            \/  \/   |_|    |_____/ \___|\__,_|_| |_|

        WordPress Security Scanner by the WPScan Team
                       Version 2.9
          Sponsored by Sucuri - https://sucuri.net
   @_WPScan_, @ethicalhack3r, @erwan_lr, pvdl, @_FireFart_
_______________________________________________________________

[+] URL: http://www.mossfon.com/
[+] Started: Mon Apr  4 18:50:19 2016

[+] robots.txt available under: 'http://www.mossfon.com/robots.txt'
[+] Interesting entry from robots.txt: http://www.mossfon.com/
[+] Interesting entry from robots.txt: http://www.mossfon.com/wp-admin/
[+] Interesting entry from robots.txt: http://www.mossfon.com/downloads/
[!] The WordPress 'http://www.mossfon.com/readme.html' file exists exposing a version number
[+] Interesting header: SERVER: Apache/2.2.15 (Oracle)
[+] Interesting header: X-CDN: Incapsula
[+] Interesting header: X-IINFO: 10-27211852-27211853 NNNN CT(292 -1 0) RT(1459810237306 4) q(0 0 3 -1) r(5 5) U6
[+] Interesting header: X-POWERED-BY: W3 Total Cache/0.9.4.1
[+] XML-RPC Interface available under: http://www.mossfon.com/xmlrpc.php

[+] WordPress version 4.2.6 identified from meta generator
[!] 2 vulnerabilities identified from the version number

[!] Title: WordPress 3.7-4.4.1 - Local URIs Server Side Request Forgery (SSRF)
    Reference: https://wpvulndb.com/vulnerabilities/8376
    Reference: https://wordpress.org/news/2016/02/wordpress-4-4-2-security-and-maintenance-release/
    Reference: https://core.trac.wordpress.org/changeset/36435
    Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2222
[i] Fixed in: 4.2.7

[!] Title: WordPress 3.7-4.4.1 - Open Redirect
    Reference: https://wpvulndb.com/vulnerabilities/8377
    Reference: https://wordpress.org/news/2016/02/wordpress-4-4-2-security-and-maintenance-release/
    Reference: https://core.trac.wordpress.org/changeset/36444
    Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2221
[i] Fixed in: 4.2.7

[+] WordPress theme in use: twentyten

[+] Name: twentyten
 |  Latest version: 2.1
 |  Location: http://www.mossfon.com/wp-content/themes/twentyten/
 |  Readme: http://www.mossfon.com/wp-content/themes/twentyten/readme.txt
 |  Style URL: http://www.mossfon.com/wp-content/themes/twentyten/style.css
 |  Referenced style.css: http://www.mossfon.com/wp-content/themes/twentyten/css/style.css
 |  Description:

[+] Enumerating plugins from passive detection ...
 | 7 plugins found:

[+] Name: contact-form-7 - v4.2.2
 |  Location: http://www.mossfon.com/wp-content/plugins/contact-form-7/
 |  Readme: http://www.mossfon.com/wp-content/plugins/contact-form-7/readme.txt
[!] The version is out of date, the latest version is 4.4.1
[!] Directory listing is enabled: http://www.mossfon.com/wp-content/plugins/contact-form-7/

[+] Name: front-end-upload - v0.6.1
 |  Latest version: 0.6.1 (up to date)
 |  Location: http://www.mossfon.com/wp-content/plugins/front-end-upload/
 |  Readme: http://www.mossfon.com/wp-content/plugins/front-end-upload/readme.txt

[+] Name: qtranslate - v2.5.32
 |  Location: http://www.mossfon.com/wp-content/plugins/qtranslate/
 |  Readme: http://www.mossfon.com/wp-content/plugins/qtranslate/readme.txt
[!] Directory listing is enabled: http://www.mossfon.com/wp-content/plugins/qtranslate/

[!] Title: qTranslate 2.5.34 - Setting Manipulation CSRF
    Reference: https://wpvulndb.com/vulnerabilities/6846
    Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3251
    Reference: https://secunia.com/advisories/53126/
    Reference: http://osvdb.org/show/osvdb/93873

[!] Title: qTranslate <= 2.5.39 - Cross-Site Scripting (XSS)
    Reference: https://wpvulndb.com/vulnerabilities/8120
    Reference: http://seclists.org/bugtraq/2015/Jul/139
    Reference: https://www.htbridge.com/advisory/HTB23265
    Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5535

[+] Name: resume-submissions-job-postings - v2.5.3
 |  Latest version: 2.5.3 (up to date)
 |  Location: http://www.mossfon.com/wp-content/plugins/resume-submissions-job-postings/
 |  Readme: http://www.mossfon.com/wp-content/plugins/resume-submissions-job-postings/readme.txt
[!] Directory listing is enabled: http://www.mossfon.com/wp-content/plugins/resume-submissions-job-postings/

[!] Title: Resume Submissions Job Posting 2.5.1 - Unrestricted File Upload
    Reference: https://wpvulndb.com/vulnerabilities/6160
    Reference: http://packetstormsecurity.com/files/114716/
    Reference: https://secunia.com/advisories/49896/
    Reference: http://osvdb.org/show/osvdb/83807
    Reference: https://www.exploit-db.com/exploits/19791/

[+] Name: wp-pagenavi - v2.87
 |  Location: http://www.mossfon.com/wp-content/plugins/wp-pagenavi/
 |  Readme: http://www.mossfon.com/wp-content/plugins/wp-pagenavi/readme.txt
[!] The version is out of date, the latest version is 2.89.1
[!] Directory listing is enabled: http://www.mossfon.com/wp-content/plugins/wp-pagenavi/

[+] Name: wp-paginate - v1.3.1
 |  Latest version: 1.3.1 (up to date)
 |  Location: http://www.mossfon.com/wp-content/plugins/wp-paginate/
 |  Readme: http://www.mossfon.com/wp-content/plugins/wp-paginate/readme.txt
[!] Directory listing is enabled: http://www.mossfon.com/wp-content/plugins/wp-paginate/

[+] Name: w3-total-cache - v0.9.4.1
 |  Latest version: 0.9.4.1 (up to date)
 |  Location: http://www.mossfon.com/wp-content/plugins/w3-total-cache/
 |  Readme: http://www.mossfon.com/wp-content/plugins/w3-total-cache/readme.txt
 |  Changelog: http://www.mossfon.com/wp-content/plugins/w3-total-cache/changelog.txt

[+] Finished: Mon Apr  4 18:51:23 2016
[+] Requests Done: 64
[+] Memory used: 79.215 MB
[+] Elapsed time: 00:01:04