ascmlsprd.wpenginepowered.com · WordPress 7.0.4 · theme hello-ascential · wpengine
| Priority | Plugin | Version | Advisory | Breaking risk | Recommendation |
|---|---|---|---|---|---|
| Critical CVE | ameliabooking active | 1.2.33 → 2.4.10 | CVE-2026-9055 CVSS 9.8 CRITICAL +27 more advisories | HIGH MAJOR version jump 1.2.33 -> 2.4.10 (API/behavior changes expected) | UPDATE NOW — actively exploitable in the installed version. Do it even though blast radius is high; capture+rollback covers us. |
| Critical CVE | elementor-pro active | 3.33.2 → 3.35.1 | CVE-2026-32475 CVSS 9.0 CRITICAL | HIGH minor version bump 3.33.2 -> 3.35.1; HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE NOW — actively exploitable in the installed version. Do it even though blast radius is high; capture+rollback covers us. |
| Critical CVE | wp-security-audit-log active | 5.5.1 → 5.6.6 | CVE-2026-54806 CVSS 9.8 CRITICAL +4 more advisories | MEDIUM minor version bump 5.5.1 -> 5.6.6 | UPDATE NOW — actively exploitable in the installed version. Do it even though blast radius is high; capture+rollback covers us. |
| Critical CVE | woocommerce inactive | 10.2.0 → 11.1.0 | CVE-2022-50972 CVSS 9.8 CRITICAL +4 more advisories | HIGH MAJOR version jump 10.2.0 -> 11.1.0 (API/behavior changes expected); HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| High CVE | image-optimization active | 1.6.9 → 1.7.6 | CVE-2026-5821 CVSS 8.1 HIGH +1 more advisories | MEDIUM minor version bump 1.6.9 -> 1.7.6 | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | jet-menu active | 2.4.8 → no fix available | CVE-2025-26953 CVSS 7.5 HIGH +1 more advisories | N/A no update available — nothing to upgrade to | NO FIX AVAILABLE — vulnerable and the vendor has no newer version installed//licensed here. Options: confirm the licence is active (premium plugins stop offering updates when a key lapses), replace the plugin, or accept the risk deliberately. Do NOT ignore silently. |
| High CVE | mainwp-child active | 6.0 → 6.2 | CVE-2026-27366 CVSS 7.5 HIGH | MEDIUM minor version bump 6.0 -> 6.2 | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | shortpixel-image-optimiser active | 6.1.1 → 6.5.6 | CVE-2026-39471 CVSS 7.2 HIGH +3 more advisories | MEDIUM multi-minor jump 6.1.1 -> 6.5.6 (skipped 4 minor releases) | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | insert-headers-and-footers active | 2.3.0 → 2.3.9 | CVE-2026-8832 CVSS 8.8 HIGH | LOW patch bump 2.3.0 -> 2.3.9 | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| Med/Low CVE | admin-site-enhancements active | 7.9.10 → 9.1.2 | CVE-2026-32423 CVSS 5.4 MEDIUM +3 more advisories | HIGH MAJOR version jump 7.9.10 -> 9.1.2 (API/behavior changes expected) | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | auto-alt-text active | 2.4.2 → 3.0.3 | CVE-2025-62866 CVSS 4.3 MEDIUM | HIGH MAJOR version jump 2.4.2 -> 3.0.3 (API/behavior changes expected) | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | elementor active | 3.33.3 → 4.2.4 | CVE-2026-32352 CVSS 6.5 MEDIUM +8 more advisories | HIGH MAJOR version jump 3.33.3 -> 4.2.4 (API/behavior changes expected); HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | mainwp-child-reports active | 2.2.6 → 2.3.1 | CVE-2026-4299 CVSS | MEDIUM minor version bump 2.2.6 -> 2.3.1 | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | simple-download-monitor active | 3.9.35 → 4.1.1 | CVE-2026-2383 CVSS | HIGH MAJOR version jump 3.9.35 -> 4.1.1 (API/behavior changes expected) | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | smtp2go active | 1.13.1 → 1.17.1 | CVE-2026-7621 CVSS 4.3 MEDIUM | MEDIUM multi-minor jump 1.13.1 -> 1.17.1 (skipped 4 minor releases) | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | duplicate-post active | 4.5 → 4.7 | CVE-2026-53740 CVSS 5.4 MEDIUM +2 more advisories | MEDIUM minor version bump 4.5 -> 4.7 | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | wordpress-seo active | 24.3 → 28.5 | CVE-2025-14481 CVSS 4.3 MEDIUM +3 more advisories | HIGH MAJOR version jump 24.3 -> 28.5 (API/behavior changes expected); HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | wordpress-seo-premium active | 24.3 → no fix available | CVE-2026-10821 CVSS 6.6 MEDIUM +1 more advisories | N/A no update available — nothing to upgrade to | No update offered for this version — likely an expired premium licence or a removed plugin. Worth a look. |
| Med/Low CVE | nitropack inactive | 1.18.5 → 1.20.0 | CVE-2026-39669 CVSS 5.3 MEDIUM | MEDIUM minor version bump 1.18.5 -> 1.20.0 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| Med/Low CVE | search-filter-pro inactive | 2.5.19 → no fix available | CVE-2025-1528 CVSS 4.3 MEDIUM | N/A no update available — nothing to upgrade to | No update offered for this version — likely an expired premium licence or a removed plugin. Worth a look. |
| Major version | agile-store-locator active | 4.10.13 → 5.4.6 | HIGH MAJOR version jump 4.10.13 -> 5.4.6 (API/behavior changes expected) | HOLD / STAGE FIRST — major jump on a high-blast-radius plugin with no security pressure. Recommend testing on a staging twin before prod. | |
| Major version | prevent-browser-caching active | 2.3.5 → 3.2.1 | HIGH MAJOR version jump 2.3.5 -> 3.2.1 (API/behavior changes expected) | HOLD / STAGE FIRST — major jump on a high-blast-radius plugin with no security pressure. Recommend testing on a staging twin before prod. | |
| Routine | eps-301-redirects active | 2.80 → 2.85 | MEDIUM multi-minor jump 2.80 -> 2.85 (skipped 5 minor releases) | UPDATE — routine maintenance bump, low risk. | |
| Routine | advanced-custom-fields-pro active | 6.3.12 → 6.8.10 | HIGH multi-minor jump 6.3.12 -> 6.8.10 (skipped 5 minor releases); HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE WITH CAPTURE — routine bump but on a sitewide-impact plugin; watch the diff closely. | |
| Routine | cookie-law-info active | 3.3.5 → 3.5.6 | MEDIUM minor version bump 3.3.5 -> 3.5.6 | UPDATE — routine maintenance bump, low risk. | |
| Routine | dynamic-content-for-elementor active | 3.3.3 → 3.4.13 | HIGH minor version bump 3.3.3 -> 3.4.13; HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE WITH CAPTURE — routine bump but on a sitewide-impact plugin; watch the diff closely. | |
| Routine | font-awesome active | 5.1.0 → 5.2.1 | MEDIUM minor version bump 5.1.0 -> 5.2.1 | UPDATE — routine maintenance bump, low risk. | |
| Routine | headers-security-advanced-hsts-wp active | 5.0.44 → 5.3.5 | MEDIUM multi-minor jump 5.0.44 -> 5.3.5 (skipped 3 minor releases) | UPDATE — routine maintenance bump, low risk. | |
| Routine | page-links-to active | 3.3.7 → 3.4.1 | MEDIUM minor version bump 3.3.7 -> 3.4.1 | UPDATE — routine maintenance bump, low risk. | |
| Routine | patchstack active | 2.3.5 → 2.3.7 | LOW patch bump 2.3.5 -> 2.3.7 | UPDATE — routine maintenance bump, low risk. | |
| Routine | wp-all-export-pro active | 1.9.11 → 1.9.15 | LOW patch bump 1.9.11 -> 1.9.15 | UPDATE — routine maintenance bump, low risk. | |
| Routine | wpe-site-migration active | 1.7.1 → 1.8.5 | MEDIUM minor version bump 1.7.1 -> 1.8.5 | UPDATE — routine maintenance bump, low risk. | |
| Routine | wp-search-with-algolia active | 2.10.3 → 2.14.1 | MEDIUM multi-minor jump 2.10.3 -> 2.14.1 (skipped 4 minor releases) | UPDATE — routine maintenance bump, low risk. | |
| Routine | cachebuster inactive | 1.8 → 1.10 | MEDIUM minor version bump 1.8 -> 1.10 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. | |
| Routine | megamenu inactive | 3.6.2 → 3.10.8 | MEDIUM multi-minor jump 3.6.2 -> 3.10.8 (skipped 4 minor releases) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. | |
| Routine | simple-banner inactive | 3.1.0 → 3.3.2 | MEDIUM minor version bump 3.1.0 -> 3.3.2 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |