Content-Security-Policy is too permissive
Effort to fix: Involved (plan it)
Why it matters
A CSP that allows 'unsafe-inline' scripts or any origin blocks almost nothing an attacker would try.
How to fix it
Remove 'unsafe-inline' and wildcard sources from script-src. Use per-request nonces or hashes for the inline scripts you need, and list specific origins.
On WordPress
Identify which plugins need inline scripts (Report-Only mode shows them) and replace or configure them; many caching plugins can add nonces.