Hi @freemordecai, thanks for reaching out with a large amount of useful information.
I would firstly recommend making the “critical” severity plugin updates to ensure you’re not running any plugin versions with known vulnerabilities on your site to resolve these particular notices.
After this, I am slightly concerned that you may be experiencing malware rather than false-positives as there are a high enough quantity of files reporting different types of scripts, infections, and code that can be detrimental to your security. It’s possible that the outdated plugins with known vulnerabilities were the entry point, but I can’t be sure.
As a rule, any time I think someone’s site has been compromised I also tell them to update their passwords for their hosting control panel, FTP, WordPress admin users, and database. Make sure to do this.
It might be an idea to email a downloaded copy of any affected file(s) showing as high severity from your scan to samples @ wordfence . com. Our Threat Intelligence team should be able to provide more detailed information around what could have happened and let you know whether a site cleaning should be performed. You can get them by visiting the file path shown in your scan result via FTP or the web-based file manager in your hosting control panel (whichever you use to manage files on your site).
Please note that when attaching files, ensure that you remove any database access credentials or keys/salts contained inside before sending.
For your information and remove any potential delay around getting you the information you need, I’ll also provide our site cleaning instructions to help you out. We recommend that you make a full backup of the site before making any changes: https://www.wordfence.com/docs/how-to-clean-a-hacked-wordpress-site-using-wordfence/
Additionally you might find the WordPress Malware Removal section in our free Learning Center helpful.
If you are unable to clean this on your own, there are paid services that will do it for you. Wordfence offers one, but there are others.
Thanks,
Peter.
