Skip to main content
Vantyris

CS-004

A small online retailer ran a pre-Q4 scan, found a CVE-flagged plugin, and patched before peak season started.

An independent e-commerce retailer (handmade goods) · West Yorkshire, England · Sole trader plus one part-time fulfilment assistant

Vantyris · Case study

CS-004 · Published 2026-05-23

An independent e-commerce retailer (handmade goods) in West Yorkshire.

Sole trader plus one part-time fulfilment assistant · e-commerce sector

Score after remediation

62 to 89

Findings closed
3 of 3
Time to first fix
about 15 minutes (plugin patch)
Time to all fixes
about 1 week

What made them run a scan

A returning customer reported their card details "felt suspect" after checking out (no actual breach, the customer's card was eventually marked clean by their bank). The owner wanted certainty before October-to-December peak season began.

What Vantyris found

  1. 01

    WordPress contact-form plugin with a known CVE in the curated set

    high

    The plugin in question had a public CVE from 2025 affecting versions earlier than the one shipped at the time of the scan. The site was on an old version.

  2. 02

    Missing Content-Security-Policy exposing checkout iframe to clickjacking risk

    medium

    The Stripe-hosted checkout iframe was loaded without an enforced CSP frame-ancestors directive. Not currently exploited, but the recommended hardening.

  3. 03

    SSL Labs grade B due to legacy ciphers from the host's default config

    medium

    The hosting account offered cipher suites that included CBC-mode TLS 1.0 fallbacks. Modern browsers do not use them but their presence drops the SSL Labs grade.

  4. 04

    Card data handled by the payment processor; no PCI scope on the site

    healthy

    Card details never touched the merchant's server, the payment processor hosted the checkout entirely. Confirmed via the scan's outbound-form audit.

What they fixed and how

The plugin update took 15 minutes once the owner approved the maintenance window. The CSP and X-Frame-Options headers were added at the Cloudflare layer with help from a community thread, about 45 minutes of work. The hosting cipher list was upgraded by the host on a support-ticket request the same week. A re-scan a fortnight before peak season returned a clean report.

In the customer's words

I have one developer I use occasionally and no security person. The report gave me the three things to ask them to fix. They were done before the end of the week.

Owner, online retailer in West Yorkshire

What's next

The retailer has scheduled a re-scan ahead of every product launch and ahead of Black Friday each year. The pattern has become part of the peak-season runbook.

Vantyris · Shield Trust HoldingsAnonymised per customer release · Reviewed 2026-05-23

Want one of these?

Run a verified scan, fix what matters, send the PDF to whoever asked. From EUR 10.

Anonymised by sector and region. Customer names, domains, and exact identifiers withheld unless explicitly released. We do not pay for participation. See our privacy policy.