See: Blocked URL: -https://www.google.nl/search?q=<!--6433c9--><script+type%3D"text%2Fjavascript"+src%3D"-http%3A%2F%2Fajmalfustan.com%2Fwp-content%2Fthemes%2Fajmalfustan%2F6x8hfh7k.php%3Fid%3D4008959"><%2Fscript><!--%2F6433c9-->&oq=<!--6433c9--><script+type%3D"text%2Fjavascript"+src%3D"-http%3A%2F%2Fajmalfustan.com%2Fwp-content%2Fthemes%2Fajmalfustan%2F6x8hfh7k.php%3Fid%3D4008959"><%2Fscript><!--%2F6433c9-->&aqs=chrome..69i57&sourceid=chrome&es_sm=93&ie=UTF-8
flagged as XSS attack code by Malware Script Decoder and Netcraft detection.
See: -http://killmalware.com/holidaycars.al/#
Index.html
Severity: Malicious
Reason: Detected encoded JavaScript code commonly used to hide malicious behaviour.
Details: Malicious obfuscated JavaScript threat
WordPress issues:
WordPress Version
3.4.1
Version does not appear to be latest 4.3.1 - update now.
Google Safe Browsing flags website.
WP-plug-ins:
WordPress Plugins
The following plugins were detected by reading the HTML source of the WordPress sites front page.
contact-form-7 latest release (4.3)
http://contactform7.com/
jquery-lightbox-for-native-galleries latest release (3.2.2)
http://www.viper007bond.com/wordpress-plugins/jquery-lightbox-for-native-galleries/
Warning User Enumeration is possible
The first two user ID’s were tested to determine if user enumeration is possible.
ID User Login
1 admin admin
2 None
Warning Directory Indexing Enabled
In the test we attempted to list the directory contents of the uploads and plugins folders to determine if Directory Indexing is enabled. This is an information leakage vulnerability that can reveal sensitive information regarding your site configuration or content.
/wp-content/uploads/ enabled
Website Risk Status: 7 red out of 10: http://toolbar.netcraft.com/site_report?url=http://ajmalfustan.com
This URL hosts a threat identified as: CYSC.DEF.GEN-2
polonus