ascentialtest.wpenginepowered.com · WordPress 7.0.4 · theme hello-ascential · wpengine
| Priority | Plugin | Version | Advisory | Breaking risk | Recommendation |
|---|---|---|---|---|---|
| Critical CVE | elementor-pro active | 3.21.3 → 3.23.3 | CVE-2026-32475 CVSS 9.0 CRITICAL +3 more advisories | HIGH minor version bump 3.21.3 -> 3.23.3; HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE NOW — actively exploitable in the installed version. Do it even though blast radius is high; capture+rollback covers us. |
| Critical CVE | hide-my-wp inactive | 5.2.01 → 7.0.11 | CVE-2025-26909 CVSS 9.6 CRITICAL +9 more advisories | HIGH MAJOR version jump 5.2.01 -> 7.0.11 (API/behavior changes expected) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| Critical CVE | nitropack inactive | 1.15.1 → 1.20.0 | CVE-2024-43922 CVSS 9.8 CRITICAL +4 more advisories | MEDIUM multi-minor jump 1.15.1 -> 1.20.0 (skipped 5 minor releases) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| High CVE | alttext-ai active | 1.6.1 → 1.10.38 | CVE-2025-46232 CVSS 8.8 HIGH +1 more advisories | MEDIUM multi-minor jump 1.6.1 -> 1.10.38 (skipped 4 minor releases) | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | jet-menu active | 2.4.4 → no fix available | CVE-2025-26953 CVSS 7.5 HIGH +1 more advisories | N/A no update available — nothing to upgrade to | NO FIX AVAILABLE — vulnerable and the vendor has no newer version installed//licensed here. Options: confirm the licence is active (premium plugins stop offering updates when a key lapses), replace the plugin, or accept the risk deliberately. Do NOT ignore silently. |
| High CVE | link-whisper active | 0.7.5 → 0.9.7 | CVE-2025-11262 CVSS 7.2 HIGH +8 more advisories | MEDIUM minor version bump 0.7.5 -> 0.9.7 | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | shortpixel-image-optimiser active | 5.6.2 → 6.5.6 | CVE-2024-48043 CVSS 7.6 HIGH +5 more advisories | HIGH MAJOR version jump 5.6.2 -> 6.5.6 (API/behavior changes expected) | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | updraftplus active | 1.24.3 → 1.26.7 | CVE-2024-10957 CVSS 8.8 HIGH +3 more advisories | HIGH minor version bump 1.24.3 -> 1.26.7; HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | wp-optimize active | 3.4.0 → 4.6.1 | CVE-2026-7252 CVSS 8.1 HIGH +2 more advisories | HIGH MAJOR version jump 3.4.0 -> 4.6.1 (API/behavior changes expected); HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | wp-all-import-pro active | 4.8.8 → no fix available | CVE-2024-9624 CVSS 7.6 HIGH +3 more advisories | N/A no update available — nothing to upgrade to | NO FIX AVAILABLE — vulnerable and the vendor has no newer version installed//licensed here. Options: confirm the licence is active (premium plugins stop offering updates when a key lapses), replace the plugin, or accept the risk deliberately. Do NOT ignore silently. |
| High CVE | insert-headers-and-footers active | 2.1.14 → 2.3.9 | CVE-2026-8832 CVSS 8.8 HIGH | MEDIUM minor version bump 2.1.14 -> 2.3.9 | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | wpide active | 3.4.9 → 3.5.9 | CVE-2026-57766 CVSS 8.8 HIGH +3 more advisories | MEDIUM minor version bump 3.4.9 -> 3.5.9 | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | debug-log-manager inactive | 2.3.3 → 2.5.2 | CVE-2025-3809 CVSS 7.2 HIGH +2 more advisories | MEDIUM minor version bump 2.3.3 -> 2.5.2 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| High CVE | wp-hide-security-enhancer inactive | 2.3.9 → 2.9.1 | CVE-2024-11585 CVSS 7.5 HIGH | MEDIUM multi-minor jump 2.3.9 -> 2.9.1 (skipped 6 minor releases) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| Med/Low CVE | advanced-custom-fields-pro active | 6.3.1.2 → 6.8.10 | CVE-2024-9529 CVSS 6.6 MEDIUM +6 more advisories | HIGH multi-minor jump 6.3.1.2 -> 6.8.10 (skipped 5 minor releases); HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | elementor active | 3.21.8 → 4.2.4 | CVE-2024-54444 CVSS 6.5 MEDIUM +21 more advisories | HIGH MAJOR version jump 3.21.8 -> 4.2.4 (API/behavior changes expected); HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | goal-tracker-ga active | 1.1.4 → 1.1.6 | CVE-2024-13362 CVSS 6.1 MEDIUM | LOW patch bump 1.1.4 -> 1.1.6 | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | limit-login-attempts-reloaded active | 2.26.11 → 3.3.8 | CVE-2026-18356 CVSS 3.7 LOW | HIGH MAJOR version jump 2.26.11 -> 3.3.8 (API/behavior changes expected) | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | query-monitor active | 3.16.3 → 4.0.7 | CVE-2026-4267 CVSS | HIGH MAJOR version jump 3.16.3 -> 4.0.7 (API/behavior changes expected) | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | search-filter-pro active | 2.5.17 → no fix available | CVE-2024-6481 CVSS 4.8 MEDIUM +1 more advisories | N/A no update available — nothing to upgrade to | No update offered for this version — likely an expired premium licence or a removed plugin. Worth a look. |
| Med/Low CVE | sucuri-scanner active | 1.8.44 → 2.8 | CVE-2026-73033 CVSS 6.5 MEDIUM | HIGH MAJOR version jump 1.8.44 -> 2.8 (API/behavior changes expected) | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | svg-support active | 2.5.5 → 2.6.1 | CVE-2024-10222 CVSS 6.4 MEDIUM +4 more advisories | MEDIUM minor version bump 2.5.5 -> 2.6.1 | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | wordpress-seo active | 22.9 → 28.5 | CVE-2025-14481 CVSS 4.3 MEDIUM +3 more advisories | HIGH MAJOR version jump 22.9 -> 28.5 (API/behavior changes expected); HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | wordpress-seo-premium active | 22.9 → no fix available | CVE-2026-10821 CVSS 6.6 MEDIUM +1 more advisories | N/A no update available — nothing to upgrade to | No update offered for this version — likely an expired premium licence or a removed plugin. Worth a look. |
| Med/Low CVE | wp-mail-smtp inactive | 4.0.1 → 4.9.0 | CVE-2024-6694 CVSS 2.7 LOW | MEDIUM multi-minor jump 4.0.1 -> 4.9.0 (skipped 9 minor releases) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| Major version | font-awesome active | 4.5.0 → 5.2.1 | HIGH MAJOR version jump 4.5.0 -> 5.2.1 (API/behavior changes expected) | HOLD / STAGE FIRST — major jump on a high-blast-radius plugin with no security pressure. Recommend testing on a staging twin before prod. | |
| Major version | prevent-browser-caching active | 2.3.5 → 3.2.1 | HIGH MAJOR version jump 2.3.5 -> 3.2.1 (API/behavior changes expected) | HOLD / STAGE FIRST — major jump on a high-blast-radius plugin with no security pressure. Recommend testing on a staging twin before prod. | |
| Major version | wordfence active | 7.11.6 → 9.0.1 | HIGH MAJOR version jump 7.11.6 -> 9.0.1 (API/behavior changes expected); HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | HOLD / STAGE FIRST — major jump on a high-blast-radius plugin with no security pressure. Recommend testing on a staging twin before prod. | |
| Major version | wpai-acf-add-on active | 3.3.8 → 4.0.2 | HIGH MAJOR version jump 3.3.8 -> 4.0.2 (API/behavior changes expected) | HOLD / STAGE FIRST — major jump on a high-blast-radius plugin with no security pressure. Recommend testing on a staging twin before prod. | |
| Routine | eps-301-redirects active | 2.75 → 2.85 | MEDIUM multi-minor jump 2.75 -> 2.85 (skipped 10 minor releases) | UPDATE — routine maintenance bump, low risk. | |
| Routine | admin-taxonomy-filter active | 1.0.4 → 1.0.5 | LOW patch bump 1.0.4 -> 1.0.5 | UPDATE — routine maintenance bump, low risk. | |
| Routine | cachebuster active | 1.6 → 1.10 | MEDIUM multi-minor jump 1.6 -> 1.10 (skipped 4 minor releases) | UPDATE — routine maintenance bump, low risk. | |
| Routine | cookie-law-info active | 3.2.4 → 3.5.6 | MEDIUM multi-minor jump 3.2.4 -> 3.5.6 (skipped 3 minor releases) | UPDATE — routine maintenance bump, low risk. | |
| Routine | duplicate-page active | 4.5.3 → 4.5.9 | LOW patch bump 4.5.3 -> 4.5.9 | UPDATE — routine maintenance bump, low risk. | |
| Routine | headers-security-advanced-hsts-wp active | 5.0.36 → 5.3.5 | MEDIUM multi-minor jump 5.0.36 -> 5.3.5 (skipped 3 minor releases) | UPDATE — routine maintenance bump, low risk. | |
| Routine | megamenu active | 3.3.1 → 3.10.8 | MEDIUM multi-minor jump 3.3.1 -> 3.10.8 (skipped 7 minor releases) | UPDATE — routine maintenance bump, low risk. | |
| Routine | page-links-to active | 3.3.7 → 3.4.1 | MEDIUM minor version bump 3.3.7 -> 3.4.1 | UPDATE — routine maintenance bump, low risk. | |
| Routine | search-regex active | 3.0.8 → 3.4.4 | MEDIUM multi-minor jump 3.0.8 -> 3.4.4 (skipped 4 minor releases) | UPDATE — routine maintenance bump, low risk. | |
| Routine | wp-revisions-control active | 1.4.3 → 1.4.4 | LOW patch bump 1.4.3 -> 1.4.4 | UPDATE — routine maintenance bump, low risk. | |
| Routine | wp-search-with-algolia active | 2.8.1 → 2.14.1 | MEDIUM multi-minor jump 2.8.1 -> 2.14.1 (skipped 6 minor releases) | UPDATE — routine maintenance bump, low risk. | |
| Routine | disable-xml-rpc-api inactive | 2.1.5 → 2.1.7 | LOW patch bump 2.1.5 -> 2.1.7 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |