naptstaging.wpenginepowered.com · WordPress 7.0.4 · theme bootscore-child · wpengine
| Priority | Plugin | Version | Advisory | Breaking risk | Recommendation |
|---|---|---|---|---|---|
| Critical CVE | ajax-search-lite active | 4.12.6 → 4.14.5 | CVE-2026-28139 CVSS 9.8 CRITICAL +3 more advisories | MEDIUM minor version bump 4.12.6 -> 4.14.5 | UPDATE NOW — actively exploitable in the installed version. Do it even though blast radius is high; capture+rollback covers us. |
| Critical CVE | elementor-pro active | 3.26.3 → no fix available | CVE-2026-32475 CVSS 9.0 CRITICAL +2 more advisories | N/A no update available — nothing to upgrade to; HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | NO FIX AVAILABLE — vulnerable and the vendor has no newer version installed//licensed here. Options: confirm the licence is active (premium plugins stop offering updates when a key lapses), replace the plugin, or accept the risk deliberately. Do NOT ignore silently. |
| Critical CVE | wp-security-audit-log active | 5.3.3 → 5.6.6 | CVE-2026-54806 CVSS 9.8 CRITICAL +4 more advisories | MEDIUM multi-minor jump 5.3.3 -> 5.6.6 (skipped 3 minor releases) | UPDATE NOW — actively exploitable in the installed version. Do it even though blast radius is high; capture+rollback covers us. |
| High CVE | ewww-image-optimizer active | 8.1.2 → 8.7.7 | CVE-2026-84773 CVSS 7.2 HIGH +1 more advisories | MEDIUM multi-minor jump 8.1.2 -> 8.7.7 (skipped 6 minor releases) | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | mainwp-child active | 5.3.5 → 6.2 | CVE-2026-27366 CVSS 7.5 HIGH | HIGH MAJOR version jump 5.3.5 -> 6.2 (API/behavior changes expected) | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | revslider active | 6.7.25 → no fix available | CVE-2026-6692 CVSS 8.8 HIGH +7 more advisories | N/A no update available — nothing to upgrade to; HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | NO FIX AVAILABLE — vulnerable and the vendor has no newer version installed//licensed here. Options: confirm the licence is active (premium plugins stop offering updates when a key lapses), replace the plugin, or accept the risk deliberately. Do NOT ignore silently. |
| High CVE | updraftplus active | 1.25.2 → 1.26.7 | CVE-2026-10795 CVSS 8.1 HIGH +1 more advisories | HIGH minor version bump 1.25.2 -> 1.26.7; HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | wp-all-import-pro active | 4.9.7 → no fix available | CVE-2024-9664 CVSS 7.2 HIGH +2 more advisories | N/A no update available — nothing to upgrade to | NO FIX AVAILABLE — vulnerable and the vendor has no newer version installed//licensed here. Options: confirm the licence is active (premium plugins stop offering updates when a key lapses), replace the plugin, or accept the risk deliberately. Do NOT ignore silently. |
| High CVE | insert-headers-and-footers active | 2.2.6 → 2.3.9 | CVE-2026-8832 CVSS 8.8 HIGH | MEDIUM minor version bump 2.2.6 -> 2.3.9 | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| Med/Low CVE | contact-form-7 active | 6.0.5 → 6.1.7 | CVE-2025-3247 CVSS 5.3 MEDIUM | MEDIUM minor version bump 6.0.5 -> 6.1.7 | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | elementor active | 3.27.7 → 4.2.4 | CVE-2024-50555 CVSS 6.5 MEDIUM +13 more advisories | HIGH MAJOR version jump 3.27.7 -> 4.2.4 (API/behavior changes expected); HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | flamingo active | 2.5 → 2.6.4 | CVE-2026-12853 CVSS 5.4 MEDIUM | MEDIUM minor version bump 2.5 -> 2.6.4 | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | simple-banner active | 3.0.4 → 3.3.2 | CVE-2024-13898 CVSS 4.4 MEDIUM +1 more advisories | MEDIUM multi-minor jump 3.0.4 -> 3.3.2 (skipped 3 minor releases) | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | wp-letsencrypt-ssl active | 7.7.5 → 7.8.7.5 | CVE-2026-3829 CVSS 5.4 MEDIUM +1 more advisories | MEDIUM minor version bump 7.7.5 -> 7.8.7.5 | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | wp-mail-logging active | 1.14.0 → 1.16.0 | CVE-2026-2471 CVSS | MEDIUM minor version bump 1.14.0 -> 1.16.0 | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | wordpress-seo active | 24.6 → 28.5 | CVE-2025-14481 CVSS 4.3 MEDIUM +3 more advisories | HIGH MAJOR version jump 24.6 -> 28.5 (API/behavior changes expected); HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Major version | wpai-acf-add-on active | 3.3.9 → 4.0.2 | HIGH MAJOR version jump 3.3.9 -> 4.0.2 (API/behavior changes expected) | HOLD / STAGE FIRST — major jump on a high-blast-radius plugin with no security pressure. Recommend testing on a staging twin before prod. | |
| Routine | advanced-custom-fields-pro active | 6.3.12 → 6.8.10 | HIGH multi-minor jump 6.3.12 -> 6.8.10 (skipped 5 minor releases); HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE WITH CAPTURE — routine bump but on a sitewide-impact plugin; watch the diff closely. | |
| Routine | duplicate-page active | 4.5.4 → 4.5.9 | LOW patch bump 4.5.4 -> 4.5.9 | UPDATE — routine maintenance bump, low risk. | |
| Routine | font-awesome active | 5.0.1 → 5.2.1 | MEDIUM minor version bump 5.0.1 -> 5.2.1 | UPDATE — routine maintenance bump, low risk. | |
| Routine | page-links-to active | 3.3.7 → 3.4.1 | MEDIUM minor version bump 3.3.7 -> 3.4.1 | UPDATE — routine maintenance bump, low risk. | |
| Routine | redirection active | 5.5.1 → 5.10.0 | MEDIUM multi-minor jump 5.5.1 -> 5.10.0 (skipped 5 minor releases) | UPDATE — routine maintenance bump, low risk. | |
| Routine | redirect-redirection active | 1.2.5 → 1.3.0 | MEDIUM minor version bump 1.2.5 -> 1.3.0 | UPDATE — routine maintenance bump, low risk. | |
| Routine | safe-svg active | 2.3.1 → 2.5.0 | MEDIUM minor version bump 2.3.1 -> 2.5.0 | UPDATE — routine maintenance bump, low risk. | |
| Routine | wp-mail-smtp active | 4.4.0 → 4.9.0 | MEDIUM multi-minor jump 4.4.0 -> 4.9.0 (skipped 5 minor releases) | UPDATE — routine maintenance bump, low risk. | |
| Routine | wp-migrate-db-pro active | 2.7.2 → 2.7.11 | LOW patch bump 2.7.2 -> 2.7.11 | UPDATE — routine maintenance bump, low risk. | |
| Routine | akismet inactive | 5.3.7 → 5.7.2 | MEDIUM multi-minor jump 5.3.7 -> 5.7.2 (skipped 4 minor releases) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. | |
| Routine | genesis-blocks inactive | 3.1.5 → 3.1.11 | LOW patch bump 3.1.5 -> 3.1.11 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |