n101.wpenginepowered.com · WordPress 7.0.4 · theme Impreza-child · wpengine
| Priority | Plugin | Version | Advisory | Breaking risk | Recommendation |
|---|---|---|---|---|---|
| Critical CVE | elementor-pro inactive | 4.0.1 → no fix available | CVE-2026-32475 CVSS 9.0 CRITICAL | N/A no update available — nothing to upgrade to; HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | NO FIX AVAILABLE — vulnerable and the vendor has no newer version installed//licensed here. Options: confirm the licence is active (premium plugins stop offering updates when a key lapses), replace the plugin, or accept the risk deliberately. Do NOT ignore silently. |
| High CVE | all-in-one-wp-migration active | 7.105 → 7.111 | CVE-2026-19949 CVSS 8.8 HIGH +2 more advisories | MEDIUM multi-minor jump 7.105 -> 7.111 (skipped 6 minor releases) | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | gravityforms active | 2.10.5 → 3.1.1 | CVE-2026-19513 CVSS 8.1 HIGH +1 more advisories | HIGH MAJOR version jump 2.10.5 -> 3.1.1 (API/behavior changes expected); HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | wp-smushit inactive | 3.24.0 → 4.3.3 | CVE-2026-81285 CVSS 7.5 HIGH +1 more advisories | HIGH MAJOR version jump 3.24.0 -> 4.3.3 (API/behavior changes expected) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| High CVE | wp-optimize inactive | 4.5.1 → 4.6.1 | CVE-2026-7252 CVSS 8.1 HIGH | HIGH minor version bump 4.5.1 -> 4.6.1; HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| High CVE | insert-headers-and-footers inactive | 2.3.5 → 2.3.9 | CVE-2026-8832 CVSS 8.8 HIGH | LOW patch bump 2.3.5 -> 2.3.9 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| High CVE | wp-fastest-cache inactive | 1.4.7 → 1.5.2 | CVE-2026-74932 CVSS 7.5 HIGH +2 more advisories | MEDIUM minor version bump 1.4.7 -> 1.5.2 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| Med/Low CVE | all-in-one-wp-migration-unlimited-extension active | 2.83 → 2.87 | CVE-2026-5753 CVSS 6.5 MEDIUM +1 more advisories | MEDIUM multi-minor jump 2.83 -> 2.87 (skipped 4 minor releases) | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | styles-and-layouts-for-gravity-forms active | 5.26 → 6.1 | CVE-2026-74004 CVSS 5.4 MEDIUM +1 more advisories | HIGH MAJOR version jump 5.26 -> 6.1 (API/behavior changes expected) | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | wordpress-seo active | 27.4 → 28.5 | CVE-2026-15425 CVSS | HIGH MAJOR version jump 27.4 -> 28.5 (API/behavior changes expected); HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | advanced-custom-fields inactive | 6.8.0 → no fix available | CVE-2026-8382 CVSS 5.3 MEDIUM +1 more advisories | N/A no update available — nothing to upgrade to; HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | No update offered for this version — likely an expired premium licence or a removed plugin. Worth a look. |
| Med/Low CVE | elementor inactive | 4.0.1 → 4.2.4 | CVE-2026-57619 CVSS 6.5 MEDIUM +3 more advisories | HIGH minor version bump 4.0.1 -> 4.2.4; HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| Med/Low CVE | limit-login-attempts-reloaded inactive | 3.1.0 → 3.3.8 | CVE-2026-18356 CVSS 3.7 LOW | MEDIUM minor version bump 3.1.0 -> 3.3.8 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| Med/Low CVE | svg-support inactive | 2.5.14 → 2.6.1 | CVE-2026-48973 CVSS 4.3 MEDIUM +1 more advisories | MEDIUM minor version bump 2.5.14 -> 2.6.1 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| Med/Low CVE | white-label-cms inactive | 2.7.9 → 2.7.14 | CVE-2026-11898 CVSS 4.4 MEDIUM | LOW patch bump 2.7.9 -> 2.7.14 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| Med/Low CVE | wp-2fa inactive | 3.1.1.2 → 4.1.0 | CVE-2026-15372 CVSS | HIGH MAJOR version jump 3.1.1.2 -> 4.1.0 (API/behavior changes expected) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| Major version | disable-wp-notification inactive | 3.4 → 4.3 | HIGH MAJOR version jump 3.4 -> 4.3 (API/behavior changes expected) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. | |
| Major version | hcaptcha-for-forms-and-more inactive | 4.25.0 → 5.3.0 | HIGH MAJOR version jump 4.25.0 -> 5.3.0 (API/behavior changes expected) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. | |
| Routine | accessibility-widget active | 3.1.3 → 3.2.6 | MEDIUM minor version bump 3.1.3 -> 3.2.6 | UPDATE — routine maintenance bump, low risk. | |
| Routine | contact-form-7 active | 6.1.5 → 6.1.7 | LOW patch bump 6.1.5 -> 6.1.7 | UPDATE — routine maintenance bump, low risk. | |
| Routine | cookie-law-info active | 3.4.0 → 3.5.6 | MEDIUM minor version bump 3.4.0 -> 3.5.6 | UPDATE — routine maintenance bump, low risk. | |
| Routine | duplicate-page active | 4.5.7 → 4.5.9 | LOW patch bump 4.5.7 -> 4.5.9 | UPDATE — routine maintenance bump, low risk. | |
| Routine | safe-svg active | 2.4.0 → 2.5.0 | MEDIUM minor version bump 2.4.0 -> 2.5.0 | UPDATE — routine maintenance bump, low risk. | |
| Routine | wordpress-importer active | 0.9.5 → 0.9.6 | LOW patch bump 0.9.5 -> 0.9.6 | UPDATE — routine maintenance bump, low risk. | |
| Routine | wp-add-mime-types active | 3.1.2 → 3.2.0 | MEDIUM minor version bump 3.1.2 -> 3.2.0 | UPDATE — routine maintenance bump, low risk. | |
| Routine | akismet inactive | 5.6 → 5.7.2 | MEDIUM minor version bump 5.6 -> 5.7.2 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. | |
| Routine | pojo-accessibility inactive | 4.1.0 → 4.1.4 | LOW patch bump 4.1.0 -> 4.1.4 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. | |
| Routine | custom-post-type-ui inactive | 1.18.3 → 1.19.3 | MEDIUM minor version bump 1.18.3 -> 1.19.3 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. | |
| Routine | headers-security-advanced-hsts-wp inactive | 5.3.2 → 5.3.5 | LOW patch bump 5.3.2 -> 5.3.5 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. | |
| Routine | post-types-order inactive | 2.4.6 → 2.5.3 | MEDIUM minor version bump 2.4.6 -> 2.5.3 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. | |
| Routine | shortpixel-image-optimiser inactive | 6.4.4 → 6.5.6 | MEDIUM minor version bump 6.4.4 -> 6.5.6 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. | |
| Routine | wp-mail-smtp inactive | 4.7.1 → 4.9.0 | MEDIUM minor version bump 4.7.1 -> 4.9.0 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |