kcacwd.wpenginepowered.com · WordPress 7.0.4 · theme hello-kitocrosby · wpengine
| Priority | Plugin | Version | Advisory | Breaking risk | Recommendation |
|---|---|---|---|---|---|
| Critical CVE | gravityforms active | 2.9.11 → no fix available | CVE-2025-12352 CVSS 9.8 CRITICAL +14 more advisories | N/A no update available — nothing to upgrade to; HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | NO FIX AVAILABLE — vulnerable and the vendor has no newer version installed//licensed here. Options: confirm the licence is active (premium plugins stop offering updates when a key lapses), replace the plugin, or accept the risk deliberately. Do NOT ignore silently. |
| Critical CVE | woocommerce active | 10.7.0 → 11.1.0 | CVE-2022-50972 CVSS 9.8 CRITICAL +2 more advisories | HIGH MAJOR version jump 10.7.0 -> 11.1.0 (API/behavior changes expected); HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE NOW — actively exploitable in the installed version. Do it even though blast radius is high; capture+rollback covers us. |
| Critical CVE | wp-security-audit-log active | 5.6.3 → 5.6.6 | CVE-2026-54806 CVSS 9.8 CRITICAL +3 more advisories | LOW patch bump 5.6.3 -> 5.6.6 | UPDATE NOW — actively exploitable in the installed version. Do it even though blast radius is high; capture+rollback covers us. |
| High CVE | ewww-image-optimizer active | 8.5.0 → 8.7.7 | CVE-2026-84773 CVSS 7.2 HIGH +1 more advisories | MEDIUM minor version bump 8.5.0 -> 8.7.7 | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | leadin active | 11.3.45 → 11.3.73 | CVE-2026-57736 CVSS 7.4 HIGH +1 more advisories | LOW patch bump 11.3.45 -> 11.3.73 | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | mainwp-child active | 6.0.10 → 6.2 | CVE-2026-27366 CVSS 7.5 HIGH | MEDIUM minor version bump 6.0.10 -> 6.2 | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | revslider active | 6.7.54 → no fix available | CVE-2026-6692 CVSS 8.8 HIGH +5 more advisories | N/A no update available — nothing to upgrade to; HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | NO FIX AVAILABLE — vulnerable and the vendor has no newer version installed//licensed here. Options: confirm the licence is active (premium plugins stop offering updates when a key lapses), replace the plugin, or accept the risk deliberately. Do NOT ignore silently. |
| High CVE | insert-headers-and-footers active | 2.3.5 → 2.3.9 | CVE-2026-8832 CVSS 8.8 HIGH | LOW patch bump 2.3.5 -> 2.3.9 | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | image-optimization inactive | 1.7.4 → 1.7.6 | CVE-2026-5821 CVSS 8.1 HIGH | LOW patch bump 1.7.4 -> 1.7.6 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| Med/Low CVE | admin-site-enhancements active | 8.7.1 → 9.1.2 | CVE-2026-12083 CVSS +1 more advisories | HIGH MAJOR version jump 8.7.1 -> 9.1.2 (API/behavior changes expected) | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | elementor active | 4.0.4 → 4.2.4 | CVE-2026-57619 CVSS 6.5 MEDIUM +3 more advisories | HIGH minor version bump 4.0.4 -> 4.2.4; HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | ajax-search-for-woocommerce active | 1.33.0 → 1.34.2 | CVE-2026-28179 CVSS 5.9 MEDIUM +1 more advisories | MEDIUM minor version bump 1.33.0 -> 1.34.2 | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | woo-product-filter active | 3.1.7 → 3.4.4 | CVE-2026-7804 CVSS 6.1 MEDIUM | MEDIUM multi-minor jump 3.1.7 -> 3.4.4 (skipped 3 minor releases) | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | google-site-kit active | 1.184.0 → 1.187.0 | CVE-2026-62139 CVSS 4.3 MEDIUM | MEDIUM multi-minor jump 1.184.0 -> 1.187.0 (skipped 3 minor releases) | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | smtp2go active | 1.14.1 → 1.17.1 | CVE-2026-7621 CVSS 4.3 MEDIUM | MEDIUM multi-minor jump 1.14.1 -> 1.17.1 (skipped 3 minor releases) | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | svg-support active | 2.5.14 → 2.6.1 | CVE-2026-48973 CVSS 4.3 MEDIUM +1 more advisories | MEDIUM minor version bump 2.5.14 -> 2.6.1 | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | wordpress-seo active | 27.5 → 28.5 | CVE-2026-15425 CVSS | HIGH MAJOR version jump 27.5 -> 28.5 (API/behavior changes expected); HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | advanced-custom-fields inactive | 6.8.0 → no fix available | CVE-2026-8382 CVSS 5.3 MEDIUM +1 more advisories | N/A no update available — nothing to upgrade to; HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | No update offered for this version — likely an expired premium licence or a removed plugin. Worth a look. |
| Med/Low CVE | enable-media-replace inactive | 4.1.9 → 4.2.2 | CVE-2026-57722 CVSS 5.9 MEDIUM | MEDIUM minor version bump 4.1.9 -> 4.2.2 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| Major version | prevent-browser-caching active | 2.3.5 → 3.2.1 | HIGH MAJOR version jump 2.3.5 -> 3.2.1 (API/behavior changes expected) | HOLD / STAGE FIRST — major jump on a high-blast-radius plugin with no security pressure. Recommend testing on a staging twin before prod. | |
| Major version | weglot active | 5.4 → 6.2 | HIGH MAJOR version jump 5.4 -> 6.2 (API/behavior changes expected) | HOLD / STAGE FIRST — major jump on a high-blast-radius plugin with no security pressure. Recommend testing on a staging twin before prod. | |
| Major version | auto-alt-text inactive | 2.8.0 → 3.0.3 | HIGH MAJOR version jump 2.8.0 -> 3.0.3 (API/behavior changes expected) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. | |
| Major version | gutenberg inactive | 23.0.1 → 24.0.0 | HIGH MAJOR version jump 23.0.1 -> 24.0.0 (API/behavior changes expected) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. | |
| Routine | advanced-custom-fields-pro active | 6.8.0.1 → 6.8.10 | HIGH patch bump 6.8.0.1 -> 6.8.10; HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE WITH CAPTURE — routine bump but on a sitewide-impact plugin; watch the diff closely. | |
| Routine | https-redirection active | 2.0.0 → 2.0.1 | LOW patch bump 2.0.0 -> 2.0.1 | UPDATE — routine maintenance bump, low risk. | |
| Routine | font-awesome active | 5.1.4 → 5.2.1 | MEDIUM minor version bump 5.1.4 -> 5.2.1 | UPDATE — routine maintenance bump, low risk. | |
| Routine | headers-security-advanced-hsts-wp active | 5.3.2 → 5.3.5 | LOW patch bump 5.3.2 -> 5.3.5 | UPDATE — routine maintenance bump, low risk. | |
| Routine | megamenu active | 3.9.1 → 3.10.8 | MEDIUM minor version bump 3.9.1 -> 3.10.8 | UPDATE — routine maintenance bump, low risk. | |
| Routine | media-sync active | 1.5.1 → 1.5.3 | LOW patch bump 1.5.1 -> 1.5.3 | UPDATE — routine maintenance bump, low risk. | |
| Routine | wp-crontrol active | 1.21.0 → 1.21.2 | LOW patch bump 1.21.0 -> 1.21.2 | UPDATE — routine maintenance bump, low risk. | |
| Routine | gf-hubspot active | 1.2.7 → 1.2.9 | LOW patch bump 1.2.7 -> 1.2.9 | UPDATE — routine maintenance bump, low risk. | |
| Routine | akismet inactive | 5.7 → 5.7.2 | LOW patch bump 5.7 -> 5.7.2 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. | |
| Routine | cookie-law-info inactive | 3.4.2 → 3.5.6 | MEDIUM minor version bump 3.4.2 -> 3.5.6 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. | |
| Routine | duplicate-page inactive | 4.5.8 → 4.5.9 | LOW patch bump 4.5.8 -> 4.5.9 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. | |
| Routine | post-types-order inactive | 2.4.6 → 2.5.3 | MEDIUM minor version bump 2.4.6 -> 2.5.3 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. | |
| Routine | wordpress-importer inactive | 0.9.5 → 0.9.6 | LOW patch bump 0.9.5 -> 0.9.6 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. | |
| Routine | csv-xml-import-for-acf inactive | 1.0.7 → 1.0.8 | LOW patch bump 1.0.7 -> 1.0.8 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. | |
| Routine | wp-search-with-algolia inactive | 2.11.3 → 2.14.1 | MEDIUM multi-minor jump 2.11.3 -> 2.14.1 (skipped 3 minor releases) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |