wingsdevsite.wpenginepowered.com · WordPress 7.0.3 · theme hello-elementor · wpengine
| Priority | Plugin | Version | Advisory | Breaking risk | Recommendation |
|---|---|---|---|---|---|
| Critical CVE | advanced-custom-fields-pro active | 6.2.9 → 6.8.10 | CVE-2024-34762 CVSS 9.9 CRITICAL +9 more advisories | HIGH multi-minor jump 6.2.9 -> 6.8.10 (skipped 6 minor releases); HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE NOW — actively exploitable in the installed version. Do it even though blast radius is high; capture+rollback covers us. |
| Critical CVE | elementor-pro active | 3.21.0 → 3.21.3 | CVE-2026-32475 CVSS 9.0 CRITICAL +5 more advisories | HIGH patch bump 3.21.0 -> 3.21.3; HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE NOW — actively exploitable in the installed version. Do it even though blast radius is high; capture+rollback covers us. |
| Critical CVE | jet-engine active | 3.4.4 → no fix available | CVE-2026-49075 CVSS 9.8 CRITICAL +32 more advisories | N/A no update available — nothing to upgrade to | NO FIX AVAILABLE — vulnerable and the vendor has no newer version installed//licensed here. Options: confirm the licence is active (premium plugins stop offering updates when a key lapses), replace the plugin, or accept the risk deliberately. Do NOT ignore silently. |
| Critical CVE | the-events-calendar active | 6.6.4.2 → 6.17.4.1 | CVE-2026-78265 CVSS 9.8 CRITICAL +19 more advisories | MEDIUM multi-minor jump 6.6.4.2 -> 6.17.4.1 (skipped 11 minor releases) | UPDATE NOW — actively exploitable in the installed version. Do it even though blast radius is high; capture+rollback covers us. |
| Critical CVE | yet-another-related-posts-plugin active | 5.30.10 → 5.30.11 | CVE-2024-43919 CVSS 9.8 CRITICAL | LOW patch bump 5.30.10 -> 5.30.11 | UPDATE NOW — actively exploitable in the installed version. Do it even though blast radius is high; capture+rollback covers us. |
| High CVE | event-tickets active | 5.10.0 → 5.29.4 | CVE-2025-11517 CVSS 7.5 HIGH +13 more advisories | MEDIUM multi-minor jump 5.10.0 -> 5.29.4 (skipped 19 minor releases) | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | jet-tricks active | 1.4.9 → no fix available | CVE-2025-26942 CVSS 7.5 HIGH +2 more advisories | N/A no update available — nothing to upgrade to | NO FIX AVAILABLE — vulnerable and the vendor has no newer version installed//licensed here. Options: confirm the licence is active (premium plugins stop offering updates when a key lapses), replace the plugin, or accept the risk deliberately. Do NOT ignore silently. |
| High CVE | shortpixel-image-optimiser active | 5.5.5 → 6.5.6 | CVE-2024-48043 CVSS 7.6 HIGH +5 more advisories | HIGH MAJOR version jump 5.5.5 -> 6.5.6 (API/behavior changes expected) | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | events-calendar-pro active | 6.5.0 → 7.8.2 | CVE-2024-8016 CVSS 7.2 HIGH | HIGH MAJOR version jump 6.5.0 -> 7.8.2 (API/behavior changes expected) | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | wordpress-importer active | 0.8.2 → 0.9.6 | CVE-2024-13889 CVSS 7.2 HIGH | MEDIUM minor version bump 0.8.2 -> 0.9.6 | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | wp-all-import-pro active | 4.8.7 → no fix available | CVE-2024-9624 CVSS 7.6 HIGH +3 more advisories | N/A no update available — nothing to upgrade to | NO FIX AVAILABLE — vulnerable and the vendor has no newer version installed//licensed here. Options: confirm the licence is active (premium plugins stop offering updates when a key lapses), replace the plugin, or accept the risk deliberately. Do NOT ignore silently. |
| High CVE | insert-headers-and-footers active | 2.1.11 → 2.3.9 | CVE-2026-8832 CVSS 8.8 HIGH | MEDIUM minor version bump 2.1.11 -> 2.3.9 | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| Med/Low CVE | auto-upload-images active | 3.3.2 → 3.4.0 | CVE-2025-49985 CVSS 0.0 | MEDIUM minor version bump 3.3.2 -> 3.4.0 | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | elementor active | 3.21.0 → 4.2.4 | CVE-2024-54444 CVSS 6.5 MEDIUM +21 more advisories | HIGH MAJOR version jump 3.21.0 -> 4.2.4 (API/behavior changes expected); HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | post-type-switcher active | 3.3.1 → 4.0.1 | CVE-2025-12524 CVSS 5.4 MEDIUM | HIGH MAJOR version jump 3.3.1 -> 4.0.1 (API/behavior changes expected) | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | search-filter-pro active | 2.5.17 → no fix available | CVE-2024-6481 CVSS 4.8 MEDIUM +1 more advisories | N/A no update available — nothing to upgrade to | No update offered for this version — likely an expired premium licence or a removed plugin. Worth a look. |
| Med/Low CVE | simple-banner active | 2.17.0 → 3.3.2 | CVE-2024-13898 CVSS 4.4 MEDIUM +2 more advisories | HIGH MAJOR version jump 2.17.0 -> 3.3.2 (API/behavior changes expected) | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Major version | prevent-browser-caching active | 2.3.5 → 3.2.1 | HIGH MAJOR version jump 2.3.5 -> 3.2.1 (API/behavior changes expected) | HOLD / STAGE FIRST — major jump on a high-blast-radius plugin with no security pressure. Recommend testing on a staging twin before prod. | |
| Major version | wpai-acf-add-on active | 3.3.8 → 4.0.2 | HIGH MAJOR version jump 3.3.8 -> 4.0.2 (API/behavior changes expected) | HOLD / STAGE FIRST — major jump on a high-blast-radius plugin with no security pressure. Recommend testing on a staging twin before prod. | |
| Routine | admin-taxonomy-filter active | 1.0.2 → 1.0.5 | LOW patch bump 1.0.2 -> 1.0.5 | UPDATE — routine maintenance bump, low risk. | |
| Routine | bulk-post-update-date active | 1.5.0 → 1.6.0 | MEDIUM minor version bump 1.5.0 -> 1.6.0 | UPDATE — routine maintenance bump, low risk. | |
| Routine | cookie-law-info active | 3.2.2 → 3.5.6 | MEDIUM multi-minor jump 3.2.2 -> 3.5.6 (skipped 3 minor releases) | UPDATE — routine maintenance bump, low risk. | |
| Routine | duplicate-page active | 4.5.3 → 4.5.9 | LOW patch bump 4.5.3 -> 4.5.9 | UPDATE — routine maintenance bump, low risk. | |
| Routine | dynamic-content-for-elementor active | 2.13.9 → 2.13.11 | HIGH patch bump 2.13.9 -> 2.13.11; HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE WITH CAPTURE — routine bump but on a sitewide-impact plugin; watch the diff closely. | |
| Routine | featured-image-admin-thumb-fiat active | 1.6 → 1.6.1 | LOW patch bump 1.6 -> 1.6.1 | UPDATE — routine maintenance bump, low risk. | |
| Routine | post-types-order active | 2.2.1 → 2.5.3 | MEDIUM multi-minor jump 2.2.1 -> 2.5.3 (skipped 3 minor releases) | UPDATE — routine maintenance bump, low risk. | |
| Routine | simple-website-redirect active | 1.2.8 → 1.3.2 | MEDIUM minor version bump 1.2.8 -> 1.3.2 | UPDATE — routine maintenance bump, low risk. | |
| Routine | wp-search-with-algolia active | 2.8.1 → 2.14.1 | MEDIUM multi-minor jump 2.8.1 -> 2.14.1 (skipped 6 minor releases) | UPDATE — routine maintenance bump, low risk. | |
| Routine | intuitive-custom-post-order inactive | 3.1.5 → 3.2.0 | MEDIUM minor version bump 3.1.5 -> 3.2.0 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |