security vulnerabilities in site:

Not really an issue. A CVE (tracking number) was recently issues for a long standing DNS re-binding exploit (and with a CVE, the security plugins now toot it).
It has a very low priority, since it relies on someone hijacking your server’s DNS resolver, you can find some details, and responses, at?https://portswigger.net/daily-swig/six-year-old-blind-ssrf-vulnerability-in-wordpress-core-feature-could-enable-ddos-attacks