How exposed is your website?
We check your site the way an attacker’s scanner does, from outside: your software, its known vulnerabilities, and how often new ones appear. Then we tell you plainly whether to move, what it takes and how long.
Example: a medical practice in Munich on WordPress, checked on 27 Oct 2026.
Security check
praxis-example.de: how exposed is it?
WordPress · PHP version hidden · HTTP Server
0 / 100
3 critical · 1 high · 5 medium
Path A · Escape the PHP trap
Move now: known, serious vulnerabilities on your current site
- JetEngine 3.0.8: 43 known vulnerabilities
- Elementor Website Builder 3.11.5: 37 known vulnerabilities
- Elementor Pro 3.9.1: 15 known vulnerabilities
- JetMenu 2.2.4: 6 known vulnerabilities
- 01
Move your content. Pages, posts, pictures and documents are imported, nothing typed again.
- 02
Design. Pick one of our designs; we fit it to your brand.
- 03
Forms and booking. Contact forms and your booking tool work on the new site.
- 04
Redirect map. Every old address points to its new page, so Google rankings carry over.
- 05
Your preview. You review the finished site on a private link before anything changes.
- 06
Mail-safe switch. Only the website's address records change. Your email (MX, SPF, DKIM) is not touched.
- 07
Handover. Delivered with an AI-readiness scorecard: found, understood, bookable.
- 08
Old server off. Once the new site runs, the PHP installation is switched off: nothing left to patch.
Time to go live
3.5–4.5 weeks
- Up to 10 pages: 2–3 weeks.
- 12 pages: +1 week.
- DocMedico: +0.5 week.
- No PHP, no plugins, no updates for you: one platform, where one fix reaches every site at once.
- Your email is never touched: only the website records change.
- Your addresses carry over, with a redirect for every one that changes.
- You see your new site on a private preview before you pay.
Plugins and themes we can see
At this rate, expect about 44 new vulnerabilities a year across them. The bar shows the chance of at least one new one in the next six months.
| Name | Yours → latest | Last update | Known holes | Next 6 months |
|---|---|---|---|---|
Hello Elementor Theme | 2.6.1 → 3.5.1 | 2026-08-25 | Medium1 | 15 % · 1 in 3 yrs |
JetMenu Plugin · Premium or custom | 2.2.4 | – | High6 | 63 % · 1 every 6 mo. |
JetEngine Plugin · Premium or custom | 3.0.8 | – | Critical43 | 100 % · 1 every 0.9 mo. |
Elementor Website Builder Plugin | 3.11.5 → 4.3.5 | 2026-10-13 | Critical37 | 100 % · 1 every 1.1 mo. |
Elementor Pro Plugin · Premium or custom | 3.9.1 | – | Critical15 | 86 % · 1 every 3 mo. |
JetThemeCore Plugin · Premium or custom | 2.3.0.3 | – | none known | 49 % · 1 every 9 mo. |
JetElements For Elementor Plugin · Premium or custom | 2.7.11 | – | Medium8 | 97 % · 1 every 1.7 mo. |
Tk Contact Form Plugin · Premium or custom | hidden | – | version hidden | none in 3 yrs |
Elfsight Slider Cc Plugin · Premium or custom | 1.1.0 | – | none known | none in 3 yrs |
JetBlocks For Elementor Plugin · Premium or custom | 1.3.20.1 | – | Medium3 | 89 % · 1 every 2.8 mo. |
What we found
- Critical
JetEngine 3.0.8: 43 known vulnerabilities
CVE-2026-49075, CVE-2026-52706, CVE-2026-66613 and 40 more. Worst: JetEngine <= 3.8.9.1 - Authenticated (Contributor+) PHP Object Injection (CVSS 9.8).
These holes are public; automated scanners look for exactly this version.
→ Update JetEngine 3.0.8 to 3.9.0.1 or newer.
Source: CVE-2026-49075 - Critical
Elementor Website Builder 3.11.5: 37 known vulnerabilities
CVE-2023-48777, CVE-2024-24934, CVE-2023-0329 and 34 more. Worst: WordPress Elementor Website Builder Plugin 3.3.0-3.18.1 is vulnerable to Arbitrary File Upload (CVSS 9.9).
These holes are public; automated scanners look for exactly this version.
→ Update Elementor Website Builder 3.11.5 to 4.3.5 or newer.
Source: CVE-2023-48777 - Critical
Elementor Pro 3.9.1: 15 known vulnerabilities
CVE-2026-32475, CVE-2023-3124, CVE-2024-23523 and 12 more. Worst: Elementor Pro <= 4.2.1 - Unauthenticated Arbitrary File Upload via Upload Field Array Validation Bypass (CVSS 9).
These holes are public; automated scanners look for exactly this version.
→ Update Elementor Pro 3.9.1 to 4.2.2 or newer.
Source: CVE-2026-32475 - High
JetMenu 2.2.4: 6 known vulnerabilities
CVE-2023-48760, CVE-2025-26953, CVE-2025-53987 and 3 more. Worst: WordPress JetMenu Plugin <= 2.4.1 is vulnerable to Broken Access Control (CVSS 8.2).
These holes are public; automated scanners look for exactly this version.
→ Update JetMenu 2.2.4 to 3.0.5.1 or newer.
Source: CVE-2023-48760 - Medium
Browsers aren't told to insist on HTTPS
No Strict-Transport-Security header.
A visitor on a hostile Wi-Fi can be pushed onto an unencrypted copy.
→ Send Strict-Transport-Security with max-age of at least six months.
- Medium
No Content Security Policy
The page doesn't limit where scripts may come from.
An injected script (e.g. through a plugin hole) runs without resistance.
→ Send a Content-Security-Policy that names the script sources you use.
- Medium
Hello Elementor 2.6.1: 1 known vulnerability
CVE-2024-31289. Worst: WordPress Hello Elementor Theme <= 3.0.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3).
These holes are public; automated scanners look for exactly this version.
→ Update Hello Elementor 2.6.1 to 3.0.1 or newer.
Source: CVE-2024-31289 - Medium
JetElements For Elementor 2.7.11: 8 known vulnerabilities
CVE-2026-24958, CVE-2026-66579, CVE-2026-105879 and 5 more. Worst: JetElements For Elementor <= 2.7.12.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.5).
These holes are public; automated scanners look for exactly this version.
→ Update JetElements For Elementor 2.7.11 to 2.9.2.6 or newer.
Source: CVE-2026-24958 - Medium
JetBlocks For Elementor 1.3.20.1: 3 known vulnerabilities
CVE-2026-66576, CVE-2026-62049, CVE-2026-61976. Worst: JetBlocks for Elementor <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.5).
These holes are public; automated scanners look for exactly this version.
→ Update JetBlocks For Elementor 1.3.20.1 to 1.5.2.2 or newer.
Source: CVE-2026-66576
- Low
The site can be framed by others
Neither X-Frame-Options nor CSP frame-ancestors is set.
Another site can show yours inside a frame to trick clicks.
→ Send frame-ancestors 'self' (or X-Frame-Options: SAMEORIGIN).
- Low
MIME sniffing not disabled
No X-Content-Type-Options: nosniff.
→ Send X-Content-Type-Options: nosniff.
- Low
The page names its CMS version
<meta name="generator" content="Elementor 3.11.5; features: e_dom_optimization, e_optimized_">.
→ Remove the generator tag.
- Low
DMARC only watches
The policy is p=none: forged mail is reported, not stopped.
→ Move to p=quarantine once reports look clean.
- Note
No referrer policy
Full page addresses may be passed to other sites.
→ Send Referrer-Policy: strict-origin-when-cross-origin.
- Note
Any certificate authority may issue for the domain
No CAA record.
→ Publish a CAA record naming your certificate authority.
- Note
No security contact
No /.well-known/security.txt.
→ Publish a security.txt so people who find a hole can reach you.
- We checked only what any visitor's browser receives. This is not a penetration test.
- 10 plugins and themes load files on the homepage. Sites usually run more; the owner-verified deep check finds all of them.
- Where a version isn't visible, we don't report it as vulnerable.
- The forecast is the rate at which new vulnerabilities were published over the last three years, not a prediction of a specific bug.
- Checked 27 Oct 2026, 10:07.