dev101inc.wpengine.com · WordPress 7.0.3 · theme hello-elementor · wpengine
| Priority | Plugin | Version | Advisory | Breaking risk | Recommendation |
|---|---|---|---|---|---|
| Critical CVE | elementor active | 3.13.0 → 4.2.4 | CVE-2023-48777 CVSS 9.9 CRITICAL +31 more advisories | HIGH MAJOR version jump 3.13.0 -> 4.2.4 (API/behavior changes expected); HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE NOW — actively exploitable in the installed version. Do it even though blast radius is high; capture+rollback covers us. |
| Critical CVE | elementor-pro active | 3.12.3 → 3.13.1 | CVE-2026-32475 CVSS 9.0 CRITICAL +12 more advisories | HIGH minor version bump 3.12.3 -> 3.13.1; HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE NOW — actively exploitable in the installed version. Do it even though blast radius is high; capture+rollback covers us. |
| High CVE | white-label-cms active | 2.5 → 2.7.14 | CVE-2024-43303 CVSS 7.1 HIGH +2 more advisories | MEDIUM minor version bump 2.5 -> 2.7.14 | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | wp-2fa active | 2.4.1 → 4.1.0 | CVE-2024-32568 CVSS 7.1 HIGH +6 more advisories | HIGH MAJOR version jump 2.4.1 -> 4.1.0 (API/behavior changes expected) | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | insert-headers-and-footers active | 2.0.11 → 2.3.9 | CVE-2026-8832 CVSS 8.8 HIGH +1 more advisories | MEDIUM multi-minor jump 2.0.11 -> 2.3.9 (skipped 3 minor releases) | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | wp-fastest-cache active | 1.1.5 → 1.5.2 | CVE-2023-6063 CVSS 7.5 HIGH +5 more advisories | MEDIUM multi-minor jump 1.1.5 -> 1.5.2 (skipped 4 minor releases) | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | shortpixel-image-optimiser inactive | 5.2.1 → 6.5.6 | CVE-2024-48043 CVSS 7.6 HIGH +8 more advisories | HIGH MAJOR version jump 5.2.1 -> 6.5.6 (API/behavior changes expected) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| Med/Low CVE | advanced-custom-fields active | 6.1.6 → 6.8.10 | CVE-2024-9529 CVSS 6.6 MEDIUM +12 more advisories | HIGH multi-minor jump 6.1.6 -> 6.8.10 (skipped 7 minor releases); HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | limit-login-attempts-reloaded active | 2.25.16 → 3.3.8 | CVE-2023-6934 CVSS 5.4 MEDIUM +2 more advisories | HIGH MAJOR version jump 2.25.16 -> 3.3.8 (API/behavior changes expected) | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | pojo-accessibility active | 2.1.0 → 4.1.4 | CVE-2026-25386 CVSS 5.3 MEDIUM +3 more advisories | HIGH MAJOR version jump 2.1.0 -> 4.1.4 (API/behavior changes expected) | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | sticky-header-effects-for-elementor active | 1.6.5 → 2.2.2 | CVE-2025-58251 CVSS 4.3 MEDIUM | HIGH MAJOR version jump 1.6.5 -> 2.2.2 (API/behavior changes expected) | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | svg-support active | 2.5.5 → 2.6.1 | CVE-2024-10222 CVSS 6.4 MEDIUM +4 more advisories | MEDIUM minor version bump 2.5.5 -> 2.6.1 | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | genesis-blocks inactive | 1.5.4 → 3.1.11 | CVE-2024-2761 CVSS 6.8 MEDIUM +3 more advisories | HIGH MAJOR version jump 1.5.4 -> 3.1.11 (API/behavior changes expected) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| Med/Low CVE | wp-mail-smtp inactive | 3.8.0 → 4.9.0 | CVE-2024-6694 CVSS 2.7 LOW | HIGH MAJOR version jump 3.8.0 -> 4.9.0 (API/behavior changes expected) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| Major version | disable-wp-notification active | 3.0 → 4.3 | HIGH MAJOR version jump 3.0 -> 4.3 (API/behavior changes expected) | HOLD / STAGE FIRST — major jump on a high-blast-radius plugin with no security pressure. Recommend testing on a staging twin before prod. | |
| Routine | admin-taxonomy-filter active | 1.0.2 → 1.0.5 | LOW patch bump 1.0.2 -> 1.0.5 | UPDATE — routine maintenance bump, low risk. | |
| Routine | cookie-law-info active | 3.0.9 → 3.5.6 | MEDIUM multi-minor jump 3.0.9 -> 3.5.6 (skipped 5 minor releases) | UPDATE — routine maintenance bump, low risk. | |
| Routine | disable-json-api active | 1.7 → 1.8 | MEDIUM minor version bump 1.7 -> 1.8 | UPDATE — routine maintenance bump, low risk. | |
| Routine | disable-xml-rpc-api active | 2.1.4.8 → 2.1.7 | LOW patch bump 2.1.4.8 -> 2.1.7 | UPDATE — routine maintenance bump, low risk. | |
| Routine | duplicate-page active | 4.5.2 → 4.5.9 | LOW patch bump 4.5.2 -> 4.5.9 | UPDATE — routine maintenance bump, low risk. | |
| Routine | headers-security-advanced-hsts-wp active | 5.0.21 → 5.3.5 | MEDIUM multi-minor jump 5.0.21 -> 5.3.5 (skipped 3 minor releases) | UPDATE — routine maintenance bump, low risk. | |
| Routine | wp-widget-disable active | 3.0.0 → 3.0.1 | LOW patch bump 3.0.0 -> 3.0.1 | UPDATE — routine maintenance bump, low risk. | |
| Routine | wp-revisions-control active | 1.4.3 → 1.4.4 | LOW patch bump 1.4.3 -> 1.4.4 | UPDATE — routine maintenance bump, low risk. |