API tools faq
paste
Guest User

Untitled

a guest
Jan 6th, 2025
169
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 11.49 KB | None | 0 0
raw download clone embed print report
  1.  
  2. \ \ / / \ / __|
  3. \ \ /\ / /| |) | (_ _ _ _ ®
  4. \ \/ \/ / | _/ _ \ / |/ ` | ' \
  5. \ /\ / | | __) | (| (| | | | |
  6. \/ \/ || |_/ ___|_,|| ||
  7. WordPress Security Scanner by the WPScan Team
  8. Version 3.8.27
  9. Sponsored by Automattic - https://automattic.com/
  10. @WPScan, @ethicalhack3r, @erwan_lr, @firefart
  11. [i] It seems like you have not updated the database for some time.
  12. [?] Do you want to update now? [Y]es [N]o, default: [N]y
  13. [i] Updating the Database ...
  14. [i] Update completed.
  15. [+] URL: https://research.23andme.com/ [104.16.182.73][+] Started: Fri Jan 3 01:12:34 2025
  16. Interesting Finding(s):
  17. [+] Headers
  18. | Interesting Entries:
  19. | - x-amz-server-side-encryption: AES256
  20. | - via: 1.1 6022b3c50d8e5cf8002901246f988028.cloudfront.net (CloudFront)
  21. | - x-amz-cf-pop: MRS53-P2
  22. | - x-amz-cf-id: zNEThCsknHwr1Hz9kUB1ype_3dCgLDPIFcnNOzdXl5Ok750zqYWFww==
  23. | - cf-cache-status: DYNAMIC
  24. | - server: cloudflare
  25. | - cf-ray: 8fc0d685fa394eb9-JNB
  26. | Found By: Headers (Passive Detection)
  27. | Confidence: 100%
  28. [i] The WordPress version could not be detected.
  29. [+] WordPress theme in use: 23andMe-Medical
  30. | Location: https://research.23andme.com/wp-content/themes/23andMe-Medical/
  31. | Style URL: https://research.23andme.com/wp-content/themes/23andMe-Medical/style.css
  32. |
  33. | Found By: Urls In Homepage (Passive Detection)
  34. |
  35. | The version could not be determined.
  36. [+] Enumerating Vulnerable Plugins (via Passive Methods)
  37. [+] Checking Plugin Versions (via Passive Methods)
  38. [i] Plugin(s) Identified:
  39. [+] contact-form-7
  40. | Location: https://research.23andme.com/wp-content/plugins/contact-form-7/
  41. | Last Updated: 2024-12-22T05:03:00.000Z
  42. | [!] The version is out of date, the latest version is 6.0.2
  43. |
  44. | Found By: Urls In Homepage (Passive Detection)
  45. |
  46. | [!] 4 vulnerabilities identified:
  47. |
  48. | [!] Title: Contact Form 7 < 5.3.2 - Unrestricted File Upload
  49. | Fixed in: 5.3.2
  50. | References:
  51. | - https://wpscan.com/vulnerability/7391118e-eef5-4ff8-a8ea-f6b65f442c63
  52. | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35489
  53. | - https://www.getastra.com/blog/911/plugin-exploit/contact-form-7-unrestricted-file-upload-vulnerability/
  54. | - https://www.jinsonvarghese.com/unrestricted-file-upload-in-contact-form-7/
  55. | - https://contactform7.com/2020/12/17/contact-form-7-532/#more-38314
  56. |
  57. | [!] Title: Contact Form 7 < 5.8.4 - Authenticated (Editor+) Arbitrary File Upload
  58. | Fixed in: 5.8.4
  59. | References:
  60. | - https://wpscan.com/vulnerability/70e21d9a-b1e6-4083-bcd3-7c1c13fd5382
  61. | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6449
  62. | - https://www.wordfence.com/threat-intel/vulnerabilities/id/5d7fb020-6acb-445e-a46b-bdb5aaf8f2b6
  63. |
  64. | [!] Title: Contact Form 7 < 5.9.2 - Reflected Cross-Site Scripting
  65. | Fixed in: 5.9.2
  66. | References:
  67. | - https://wpscan.com/vulnerability/1c070a2c-2ab0-43bf-b10b-6575709918bc
  68. | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2242
  69. | - https://www.wordfence.com/threat-intel/vulnerabilities/id/d5bf4972-424a-4470-a0bc-7dcc95378e0e
  70. |
  71. | [!] Title: Contact Form 7 < 5.9.5 - Unauthenticated Open Redirect
  72. | Fixed in: 5.9.5
  73. | References:
  74. | - https://wpscan.com/vulnerability/8bdcdb5a-9026-4157-8592-345df8fb1a17
  75. | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4704
  76. |
  77. | Version: 5.2 (20% confidence)
  78. | Found By: Query Parameter (Passive Detection)
  79. | - https://research.23andme.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.2
  80. | - https://research.23andme.com/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.2
  81. [+] js_composer
  82. | Location: https://research.23andme.com/wp-content/plugins/js_composer/
  83. | Last Updated: 2024-12-11T19:40:45.000Z
  84. | [!] The version is out of date, the latest version is 8.1
  85. |
  86. | Found By: Urls In Homepage (Passive Detection)
  87. | Confirmed By: Body Tag (Passive Detection)
  88. |
  89. | [!] 9 vulnerabilities identified:
  90. |
  91. | [!] Title: WPBakery Page Builder < 6.4.1 - Authenticated Stored Cross-Site Scripting (XSS)
  92. | Fixed in: 6.4.1
  93. | References:
  94. | - https://wpscan.com/vulnerability/11285589-1b22-4ec0-adfc-f2add70db4d7
  95. | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28650
  96. | - https://www.wordfence.com/blog/2020/10/vulnerability-exposes-over-4-million-sites-using-wpbakery/
  97. |
  98. | [!] Title: WPBakery Page Builder < 6.13.0 - Contributor+ Stored XSS
  99. | Fixed in: 6.13.0
  100. | References:
  101. | - https://wpscan.com/vulnerability/ee99521d-be25-41ef-8988-5cfd66e9c5ca
  102. | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-31213
  103. |
  104. | [!] Title: WPBakery Visual Composer < 7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title tag attribute
  105. | Fixed in: 7.6
  106. | References:
  107. | - https://wpscan.com/vulnerability/787a71f8-1179-4442-9441-87fbe83a7e67
  108. | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1841
  109. | - https://www.wordfence.com/threat-intel/vulnerabilities/id/34d21418-4faf-40bf-a960-79482a592722
  110. |
  111. | [!] Title: WPBakery Visual Composer < 7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Heading tag attribute
  112. | Fixed in: 7.6
  113. | References:
  114. | - https://wpscan.com/vulnerability/8ebfad34-7b46-4783-9fad-c96ab4f4c737
  115. | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1842
  116. | - https://www.wordfence.com/threat-intel/vulnerabilities/id/674e6722-d293-4572-80bf-984e74c3e33f
  117. |
  118. | [!] Title: WPBakery Visual Composer < 7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button onclick attribute
  119. | Fixed in: 7.6
  120. | References:
  121. | - https://wpscan.com/vulnerability/b87926cd-0fe0-49df-8c61-9df1363a67a8
  122. | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1805
  123. | - https://www.wordfence.com/threat-intel/vulnerabilities/id/7a571386-fae1-4a56-8567-9d3e23249de1
  124. |
  125. | [!] Title: WPBakery Visual Composer < 7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Author
  126. | Fixed in: 7.6
  127. | References:
  128. | - https://wpscan.com/vulnerability/b41c2343-3be4-4bd9-ae5d-69ae96ba23ae
  129. | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1840
  130. | - https://www.wordfence.com/threat-intel/vulnerabilities/id/cb8ecbbc-ada9-4887-92e6-25a587ecfb84
  131. |
  132. | [!] Title: WPBakery Page Builder < 7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via VC Single Image link attribute
  133. | Fixed in: 7.7
  134. | References:
  135. | - https://wpscan.com/vulnerability/3b067a13-ee58-44c9-80af-ae04af6256c8
  136. | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5265
  137. | - https://www.wordfence.com/threat-intel/vulnerabilities/id/35a5114e-5c5f-4003-8bb3-77243ffbac1a
  138. |
  139. | [!] Title: WPBakery < 7.8 - Authenticated (Author+) Stored Cross-Site Scripting
  140. | Fixed in: 7.8
  141. | References:
  142. | - https://wpscan.com/vulnerability/992e5d47-e290-420a-adf8-f552a929e51d
  143. | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5708
  144. | - https://www.wordfence.com/threat-intel/vulnerabilities/id/23ff12f0-eb9d-4bb3-8db0-0e794c0f0594
  145. |
  146. | [!] Title: WPBakery < 7.8 - Authenticated (Author+) Local File Inclusion
  147. | Fixed in: 7.8
  148. | References:
  149. | - https://wpscan.com/vulnerability/6e3e1944-67f7-405e-ae4f-f0ab8c6c9acd
  150. | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5709
  151. | - https://www.wordfence.com/threat-intel/vulnerabilities/id/7fad30c8-fd8a-4cf2-a3aa-16a374231b87
  152. |
  153. | Version: 6.1 (80% confidence)
  154. | Found By: Body Tag (Passive Detection)
  155. | - https://research.23andme.com/, Match: 'js-comp-ver-6.1'
  156. | Confirmed By: Query Parameter (Passive Detection)
  157. | - https://research.23andme.com/wp-content/plugins/js_composer/assets/css/js_composer.min.css?ver=6.1
  158. | - https://research.23andme.com/wp-content/plugins/js_composer/assets/js/dist/js_composer_front.min.js?ver=6.1
  159. [+] wpcf7-redirect
  160. | Location: https://research.23andme.com/wp-content/plugins/wpcf7-redirect/
  161. | Latest Version: 3.1.9
  162. | Last Updated: 2024-11-12T22:31:00.000Z
  163. |
  164. | Found By: Urls In Homepage (Passive Detection)
  165. |
  166. | [!] 10 vulnerabilities identified:
  167. |
  168. | [!] Title: Redirection for Contact Form 7 < 2.3.4 - Unauthenticated Arbitrary Nonce Generation
  169. | Fixed in: 2.3.4
  170. | References:
  171. | - https://wpscan.com/vulnerability/99f30604-d62b-4e30-afcd-b482f8d66413
  172. | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24278
  173. | - https://www.wordfence.com/blog/2021/04/severe-vulnerabilities-patched-in-redirection-for-contact-form-7-plugin/
  174. |
  175. | [!] Title: Redirection for Contact Form 7 < 2.3.4 - Authenticated Arbitrary Plugin Installation
  176. | Fixed in: 2.3.4
  177. | References:
  178. | - https://wpscan.com/vulnerability/75f7690d-7f6b-48a8-a9d1-95578a657920
  179. | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24279
  180. | - https://www.wordfence.com/blog/2021/04/severe-vulnerabilities-patched-in-redirection-for-contact-form-7-plugin/
  181. |
  182. | [!] Title: Redirection for Contact Form 7 < 2.3.4 - Authenticated PHP Object Injection
  183. | Fixed in: 2.3.4
  184. | References:
  185. | - https://wpscan.com/vulnerability/db4ba6b0-887e-4ec1-8935-ab21d369b329
  186. | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24280
  187. | - https://www.wordfence.com/blog/2021/04/severe-vulnerabilities-patched-in-redirection-for-contact-form-7-plugin/
  188. |
  189. | [!] Title: Redirection for Contact Form 7 < 2.3.4 - Authenticated Arbitrary Post Deletion
  190. | Fixed in: 2.3.4
  191. | References:
  192. | - https://wpscan.com/vulnerability/daf12b85-f5ad-4261-ab39-be6840ad3cdc
  193. | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24281
  194. | - https://www.wordfence.com/blog/2021/04/severe-vulnerabilities-patched-in-redirection-for-contact-form-7-plugin/
  195. |
  196. | [!] Title: Redirection for Contact Form 7 < 2.3.4 - Unprotected AJAX Actions
  197. | Fixed in: 2.3.4
  198. | References:
  199. | - https://wpscan.com/vulnerability/def87e69-bade-431b-b101-d463a26406e9
  200. | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24282
  201. | - https://www.wordfence.com/blog/2021/04/severe-vulnerabilities-patched-in-redirection-for-contact-form-7-plugin/
  202. |
  203. | [!] Title: Unauthorised AJAX Calls via Freemius
  204. | Fixed in: 2.5.0
  205. | Reference: https://wpscan.com/vulnerability/6dae6dca-7474-4008-9fe5-4c62b9f12d0a
  206. |
  207. | [!] Title: Redirection for Contact Form 7 < 2.5.0 - Reflected Cross-Site Scripting
  208. | Fixed in: 2.5.0
  209. | References:
  210. | - https://wpscan.com/vulnerability/05700942-3143-4978-89eb-814ceff74867
  211. | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0250
  212. |
  213. | [!] Title: Redirection for Contact Form 7 < 2.6.0 - Unauthenticated Options Update to Stored XSS
  214. | Fixed in: 2.6.0
  215. | References:
  216. | - https://wpscan.com/vulnerability/f42b2c72-50dd-4b76-84ad-8322c1a6e051
  217. | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36913
  218. |
  219. | [!] Title: Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
  220. | Fixed in: 2.9.0
  221. | References:
  222. | - https://wpscan.com/vulnerability/58ab5352-d783-431a-b0a5-382381cc13fd
  223. | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-33999
  224. |
  225. | [!] Title: Redirection for Contact Form 7 < 3.0.0 - Missing Authorization
  226. | Fixed in: 3.0.0
  227. | References:
  228. | - https://wpscan.com/vulnerability/74ebe3ab-3af5-4bde-a943-2c97667a400a
  229. | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39920
  230. | - https://www.wordfence.com/threat-intel/vulnerabilities/id/9cf17c08-25b7-450d-acd9-963a1f79e495
  231. |
  232. | The version could not be determined.
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!