0. Status
WPscan identified 18 vulnerabilities
1. Core Updates
Updated core from 6.6.1 to 6.7.1
2. Removed plugins
- None
3. Plugin Udates (19 requested)
N.B. The following premium
- Updated "Activity Log" from 2.11.0 to 2.11.2
- Updated "Advanced Custom Fields" from 6.3.5 to 6.3.10.2
- Updated "All In One WP Security" from 5.3.2 to 5.3.4
- Updated "Easy WP SMTP" from 2.4.1 a 2.7.0
- Updated "Elementor" from 3.23.4 to 3.25.10
- Updated "Elementor Addon Elements" from 1.13.6 to 1.13.9
- Updated "Essential Addons for Elementor" from 6.0.1 to 6.0.10
- Updated "GDPR Cookie Compliance" from 4.15.2 to 4.15.5
- Updated "Gravity Forms Event Tracking" from 2.4.14 to 2.5.0
- Updated "Really Simple SSL" from 8.1.6 to 9.1.2
- Updated "Redirection" from 5.5.0 to 5.5.1
- Updated "Smart Slider 3" from 3.5.1.23 to 3.5.1.25
- Updated "W3 Total Cache" from 2.7.5 to 2.8.0
- Updated "Yoast SEO" from 23.3 to 23.9
3.1 NB , lincences
- The following premium
- "BE Theme" lincence has been ourchased, renewed and updated from 27.4.3 to 27.5.13
- "WPBakery Page Builder" lincence is no longer valid, it requires a new licence to be updated.
4. Themes updates (2 requested)
- Updated Twenty Twenty-Four from 1.2 to 1.3
- Updated Twenty Twenty-Three from 1.5 to 1.6
5. Additional activities
5.1 Security activities
- None
Onetime activities
- None
Recurring activities
- Renamed "xmlrpc.php" to "donotpass_xmlrpc.php" (should be done on EVERY core update)
- Removed "readme.txt" (should be done on EVERY core update)
- Removed "license.txt" (should be done on EVERY core update)
- Removed "licenza.html" (should be done on EVERY core update)
N.B Gravity Form plugin can not be automatically updated due to a licence lack
5.2 Spam Found
- no more spams found
5.3 Cookies
PLEASE CHECK with your legal consultant if the cookie banner is already mandatory.
Currently the website does not use any cookies.
T318114: Configure WMIT Matomo to do not use cookies
6. Notices
6.0 Licences renew are required
- WPBakery Page Builder
6.1 Too many editor are installed.
Currently on wikimedia.it wordpress website are intalled and used the following editors:
- Default "Gutenberg" default wordpress editor
- BE Editor
- Elementor
Those editors are not fully compatible and interoperable. That means that, choosing a wrong editor, there is a high risk to broke contents and to create not uniform contents.
6.2 Fragmented template elements and styles
Due to wordpress architecture and stratification of manutentive ad evolutive actions, currently styles are spread in:
- WMI wordpress theme
- Inline wordpress styles
- Editors configurations (Elementor, BE)
- Plugins configurations (Smart Slider)
This configuration makes hard to maintain end act on global styles, keeping a global aesthetic identity
6.3 The Plugin "Wiki Embed" - https://it.wordpress.org/plugins/wiki-embed/ - is old and no longer mantenined (9 years from the last update)
It causes a lot of PHP warnings
Trying to access array offset on value of type bool in /var/www/wmi/wordpress/wp-content/plugins/wiki-embed/WikiEmbed.php on line 112
6.4 Other activities
- Homepage:
- Corrected "Newsletter form" button behaviour
- "/wikimedia-per-la-conoscenza-libera/wikimedia-per-open-mapping/attivita-realizzate/" buttons corrected