www.ascentialtech.com · WordPress 7.0.4 · theme hello-ascential · wpengine
| Priority | Plugin | Version | Advisory | Breaking risk | Recommendation |
|---|---|---|---|---|---|
| Critical CVE | elementor-pro active | 3.30.1 → 4.2.3 | CVE-2026-32475 CVSS 9.0 CRITICAL | HIGH MAJOR version jump 3.30.1 -> 4.2.3 (API/behavior changes expected); HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE NOW — actively exploitable in the installed version. Do it even though blast radius is high; capture+rollback covers us. |
| High CVE | mainwp-child active | 6.0.10 → 6.2 | CVE-2026-27366 CVSS 7.5 HIGH | MEDIUM minor version bump 6.0.10 -> 6.2 | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| Med/Low CVE | interactive-3d-flipbook-powered-physics-engine active | 1.16.19 → 1.16.22 | CVE-2026-74007 CVSS 5.3 MEDIUM +1 more advisories | LOW patch bump 1.16.19 -> 1.16.22 | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | admin-site-enhancements active | 8.8.1 → 9.1.2 | CVE-2026-12083 CVSS +1 more advisories | HIGH MAJOR version jump 8.8.1 -> 9.1.2 (API/behavior changes expected) | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | elementor active | 3.35.5 → 4.2.4 | CVE-2026-32352 CVSS 6.5 MEDIUM +7 more advisories | HIGH MAJOR version jump 3.35.5 -> 4.2.4 (API/behavior changes expected); HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | sucuri-scanner active | 2.7.2 → 2.8 | CVE-2026-73033 CVSS 6.5 MEDIUM | MEDIUM minor version bump 2.7.2 -> 2.8 | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | wp-security-audit-log active | 5.6.4 → 5.6.6 | CVE-2026-65512 CVSS 5.4 MEDIUM | LOW patch bump 5.6.4 -> 5.6.6 | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | wordpress-seo active | 27.7 → 28.5 | CVE-2026-15425 CVSS | HIGH MAJOR version jump 27.7 -> 28.5 (API/behavior changes expected); HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | wordpress-seo-premium active | 24.3 → no fix available | CVE-2026-10821 CVSS 6.6 MEDIUM +1 more advisories | N/A no update available — nothing to upgrade to | No update offered for this version — likely an expired premium licence or a removed plugin. Worth a look. |
| Med/Low CVE | duplicate-post inactive | 4.6 → 4.7 | CVE-2026-53740 CVSS 5.4 MEDIUM +1 more advisories | MEDIUM minor version bump 4.6 -> 4.7 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| Major version | prevent-browser-caching inactive | 2.3.6 → 3.2.1 | HIGH MAJOR version jump 2.3.6 -> 3.2.1 (API/behavior changes expected) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. | |
| Major version | weglot inactive | 5.5 → 6.2 | HIGH MAJOR version jump 5.5 -> 6.2 (API/behavior changes expected) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. | |
| Routine | eps-301-redirects active | 2.84 → 2.85 | MEDIUM minor version bump 2.84 -> 2.85 | UPDATE — routine maintenance bump, low risk. | |
| Routine | advanced-custom-fields-pro active | 6.7.0.2 → 6.8.10 | HIGH minor version bump 6.7.0.2 -> 6.8.10; HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE WITH CAPTURE — routine bump but on a sitewide-impact plugin; watch the diff closely. | |
| Routine | contact-form-7 active | 6.1.6 → 6.1.7 | LOW patch bump 6.1.6 -> 6.1.7 | UPDATE — routine maintenance bump, low risk. | |
| Routine | headers-security-advanced-hsts-wp active | 5.3.2 → 5.3.5 | LOW patch bump 5.3.2 -> 5.3.5 | UPDATE — routine maintenance bump, low risk. | |
| Routine | smtp2go active | 1.17.0 → 1.17.1 | LOW patch bump 1.17.0 -> 1.17.1 | UPDATE — routine maintenance bump, low risk. | |
| Routine | insert-headers-and-footers active | 2.3.6 → 2.3.9 | LOW patch bump 2.3.6 -> 2.3.9 | UPDATE — routine maintenance bump, low risk. | |
| Routine | wp-search-with-algolia active | 2.11.3 → 2.14.1 | MEDIUM multi-minor jump 2.11.3 -> 2.14.1 (skipped 3 minor releases) | UPDATE — routine maintenance bump, low risk. | |
| Routine | cookie-law-info inactive | 3.5.1 → 3.5.6 | LOW patch bump 3.5.1 -> 3.5.6 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. | |
| Routine | query-monitor inactive | 4.0.6 → 4.0.7 | LOW patch bump 4.0.6 -> 4.0.7 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. | |
| Routine | view-transitions inactive | 1.2.0 → 1.2.1 | LOW patch bump 1.2.0 -> 1.2.1 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. | |
| Routine | wp-optimize inactive | 4.5.4 → 4.6.1 | HIGH minor version bump 4.5.4 -> 4.6.1; HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. | |
| Routine | csv-xml-import-for-acf inactive | 1.0.7 → 1.0.8 | LOW patch bump 1.0.7 -> 1.0.8 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |