b64.wpenginepowered.com · WordPress 7.0.3 · theme bootscore-child · wpengine
| Priority | Plugin | Version | Advisory | Breaking risk | Recommendation |
|---|---|---|---|---|---|
| High CVE | ewww-image-optimizer active | 8.0.0 → 8.7.7 | CVE-2026-84773 CVSS 7.2 HIGH +1 more advisories | MEDIUM multi-minor jump 8.0.0 -> 8.7.7 (skipped 7 minor releases) | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | updraftplus active | 1.25.1 → 1.26.7 | CVE-2026-10795 CVSS 8.1 HIGH +1 more advisories | HIGH minor version bump 1.25.1 -> 1.26.7; HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | wp-optimize active | 3.8.0 → 4.6.1 | CVE-2026-7252 CVSS 8.1 HIGH +2 more advisories | HIGH MAJOR version jump 3.8.0 -> 4.6.1 (API/behavior changes expected); HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | insert-headers-and-footers active | 2.2.5 → 2.3.9 | CVE-2026-8832 CVSS 8.8 HIGH | MEDIUM minor version bump 2.2.5 -> 2.3.9 | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | wpide active | 3.5.0 → 3.5.9 | CVE-2026-57766 CVSS 8.8 HIGH +2 more advisories | LOW patch bump 3.5.0 -> 3.5.9 | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | mainwp-child inactive | 5.3.4 → 6.2 | CVE-2026-27366 CVSS 7.5 HIGH | HIGH MAJOR version jump 5.3.4 -> 6.2 (API/behavior changes expected) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| Med/Low CVE | limit-login-attempts-reloaded active | 2.26.16 → 3.3.8 | CVE-2026-18356 CVSS 3.7 LOW | HIGH MAJOR version jump 2.26.16 -> 3.3.8 (API/behavior changes expected) | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | query-monitor active | 3.17.0 → 4.0.7 | CVE-2026-4267 CVSS | HIGH MAJOR version jump 3.17.0 -> 4.0.7 (API/behavior changes expected) | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | search-filter-pro active | 2.5.19 → no fix available | CVE-2025-1528 CVSS 4.3 MEDIUM | N/A no update available — nothing to upgrade to | No update offered for this version — likely an expired premium licence or a removed plugin. Worth a look. |
| Med/Low CVE | simple-banner active | 3.0.4 → 3.3.2 | CVE-2024-13898 CVSS 4.4 MEDIUM +1 more advisories | MEDIUM multi-minor jump 3.0.4 -> 3.3.2 (skipped 3 minor releases) | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | smtp2go active | 1.11.1 → 1.17.1 | CVE-2025-54011 CVSS 4.3 MEDIUM +1 more advisories | MEDIUM multi-minor jump 1.11.1 -> 1.17.1 (skipped 6 minor releases) | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | gutenberg inactive | 20.1.0 → 24.0.0 | CVE-2025-64354 CVSS 6.5 MEDIUM | HIGH MAJOR version jump 20.1.0 -> 24.0.0 (API/behavior changes expected) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| Med/Low CVE | wordpress-seo inactive | 24.3 → 28.5 | CVE-2025-14481 CVSS 4.3 MEDIUM +3 more advisories | HIGH MAJOR version jump 24.3 -> 28.5 (API/behavior changes expected); HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| Major version | online-active-users active | 2.5 → 3.4.4 | HIGH MAJOR version jump 2.5 -> 3.4.4 (API/behavior changes expected) | HOLD / STAGE FIRST — major jump on a high-blast-radius plugin with no security pressure. Recommend testing on a staging twin before prod. | |
| Major version | prevent-browser-caching active | 2.3.5 → 3.2.1 | HIGH MAJOR version jump 2.3.5 -> 3.2.1 (API/behavior changes expected) | HOLD / STAGE FIRST — major jump on a high-blast-radius plugin with no security pressure. Recommend testing on a staging twin before prod. | |
| Major version | wpae-acf-add-on active | 1.0.5 → 2.0.0 | HIGH MAJOR version jump 1.0.5 -> 2.0.0 (API/behavior changes expected) | HOLD / STAGE FIRST — major jump on a high-blast-radius plugin with no security pressure. Recommend testing on a staging twin before prod. | |
| Major version | wpai-acf-add-on active | 3.3.9 → 4.0.2 | HIGH MAJOR version jump 3.3.9 -> 4.0.2 (API/behavior changes expected) | HOLD / STAGE FIRST — major jump on a high-blast-radius plugin with no security pressure. Recommend testing on a staging twin before prod. | |
| Routine | eps-301-redirects active | 2.77 → 2.85 | MEDIUM multi-minor jump 2.77 -> 2.85 (skipped 8 minor releases) | UPDATE — routine maintenance bump, low risk. | |
| Routine | admin-taxonomy-filter active | 1.0.4 → 1.0.5 | LOW patch bump 1.0.4 -> 1.0.5 | UPDATE — routine maintenance bump, low risk. | |
| Routine | advanced-custom-fields-pro active | 6.3.12 → 6.8.10 | HIGH multi-minor jump 6.3.12 -> 6.8.10 (skipped 5 minor releases); HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE WITH CAPTURE — routine bump but on a sitewide-impact plugin; watch the diff closely. | |
| Routine | cookie-law-info active | 3.2.8 → 3.5.6 | MEDIUM multi-minor jump 3.2.8 -> 3.5.6 (skipped 3 minor releases) | UPDATE — routine maintenance bump, low risk. | |
| Routine | duplicate-page active | 4.5.4 → 4.5.9 | LOW patch bump 4.5.4 -> 4.5.9 | UPDATE — routine maintenance bump, low risk. | |
| Routine | megamenu active | 3.4.1 → 3.10.8 | MEDIUM multi-minor jump 3.4.1 -> 3.10.8 (skipped 6 minor releases) | UPDATE — routine maintenance bump, low risk. | |
| Routine | wps-hide-login active | 1.9.17.1 → 1.9.19 | LOW patch bump 1.9.17.1 -> 1.9.19 | UPDATE — routine maintenance bump, low risk. | |
| Routine | classic-editor inactive | 1.6.7 → 1.7.0 | MEDIUM minor version bump 1.6.7 -> 1.7.0 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |