firebranddedev.wpenginepowered.com · WordPress 7.0.3 · theme Firebrand · wpengine
| Priority | Plugin | Version | Advisory | Breaking risk | Recommendation |
|---|---|---|---|---|---|
| Critical CVE | woocommerce active | 11.0.1 → 11.1.0 | CVE-2022-50972 CVSS 9.8 CRITICAL +1 more advisories | HIGH minor version bump 11.0.1 -> 11.1.0; HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE NOW — actively exploitable in the installed version. Do it even though blast radius is high; capture+rollback covers us. |
| High CVE | duracelltomi-google-tag-manager active | 1.21.1 → 2.0.2 | CVE-2026-16597 CVSS 7.2 HIGH | HIGH MAJOR version jump 1.21.1 -> 2.0.2 (API/behavior changes expected) | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | mainwp-child active | 5.4.0.11 → 6.2 | CVE-2026-27366 CVSS 7.5 HIGH | HIGH MAJOR version jump 5.4.0.11 -> 6.2 (API/behavior changes expected) | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | password-protect-page active | 1.9.12 → 1.9.24 | CVE-2026-0551 CVSS 8.8 HIGH +6 more advisories | LOW patch bump 1.9.12 -> 1.9.24 | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | insert-headers-and-footers active | 2.2.9 → 2.3.9 | CVE-2026-8832 CVSS 8.8 HIGH | MEDIUM minor version bump 2.2.9 -> 2.3.9 | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | wpforms-lite active | 1.9.6.2 → 2.0.1.1 | CVE-2026-40764 CVSS 8.1 HIGH +8 more advisories | HIGH MAJOR version jump 1.9.6.2 -> 2.0.1.1 (API/behavior changes expected); HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | updraftplus inactive | 1.25.6 → 1.26.7 | CVE-2026-10795 CVSS 8.1 HIGH +1 more advisories | HIGH minor version bump 1.25.6 -> 1.26.7; HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| High CVE | wp-rocket inactive | 3.19.2.1 → no fix available | CVE-2026-5934 CVSS 7.2 HIGH +2 more advisories | N/A no update available — nothing to upgrade to; HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | NO FIX AVAILABLE — vulnerable and the vendor has no newer version installed//licensed here. Options: confirm the licence is active (premium plugins stop offering updates when a key lapses), replace the plugin, or accept the risk deliberately. Do NOT ignore silently. |
| Med/Low CVE | admin-menu-editor active | 1.14 → 1.15.2 | CVE-2025-9493 CVSS 6.4 MEDIUM +1 more advisories | MEDIUM minor version bump 1.14 -> 1.15.2 | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | advanced-custom-fields active | 6.4.3 → 6.8.10 | CVE-2026-8382 CVSS 5.3 MEDIUM +2 more advisories | HIGH multi-minor jump 6.4.3 -> 6.8.10 (skipped 4 minor releases); HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | custom-post-type-ui active | 1.17.3 → 1.19.3 | CVE-2025-12826 CVSS 4.8 MEDIUM +1 more advisories | MEDIUM minor version bump 1.17.3 -> 1.19.3 | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | pdf-embedder active | 4.9.2 → 5.0.2 | CVE-2026-7526 CVSS 4.3 MEDIUM | HIGH MAJOR version jump 4.9.2 -> 5.0.2 (API/behavior changes expected) | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | printful-shipping-for-woocommerce active | 2.2.11 → 2.2.12 | CVE-2025-12375 CVSS 6.4 MEDIUM | LOW patch bump 2.2.11 -> 2.2.12 | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | jetpack inactive | 14.8 → 16.2 | CVE-2024-10858 CVSS 6.1 MEDIUM +1 more advisories | HIGH MAJOR version jump 14.8 -> 16.2 (API/behavior changes expected) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| Med/Low CVE | post-type-switcher inactive | 4.0.0 → 4.0.1 | CVE-2025-12524 CVSS 5.4 MEDIUM | LOW patch bump 4.0.0 -> 4.0.1 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| Med/Low CVE | really-simple-csv-importer inactive | 1.3 → 1.3.1 | CVE-2026-65461 CVSS | LOW patch bump 1.3 -> 1.3.1 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| Med/Low CVE | svg-support inactive | 2.5.14 → 2.6.1 | CVE-2026-48973 CVSS 4.3 MEDIUM +1 more advisories | MEDIUM minor version bump 2.5.14 -> 2.6.1 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| Med/Low CVE | wp-file-manager inactive | 8.0.2 → 8.0.4 | CVE-2026-6382 CVSS | LOW patch bump 8.0.2 -> 8.0.4 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| Major version | pdfjs-viewer-shortcode active | 2.2.2 → 3.1.1 | HIGH MAJOR version jump 2.2.2 -> 3.1.1 (API/behavior changes expected) | HOLD / STAGE FIRST — major jump on a high-blast-radius plugin with no security pressure. Recommend testing on a staging twin before prod. | |
| Routine | userway-accessibility-widget active | 2.6.5 → 2.6.6 | LOW patch bump 2.6.5 -> 2.6.6 | UPDATE — routine maintenance bump, low risk. | |
| Routine | akismet active | 5.7 → 5.7.2 | LOW patch bump 5.7 -> 5.7.2 | UPDATE — routine maintenance bump, low risk. | |
| Routine | classic-editor active | 1.6.7 → 1.7.0 | MEDIUM minor version bump 1.6.7 -> 1.7.0 | UPDATE — routine maintenance bump, low risk. | |
| Routine | duplicate-page active | 4.5.5 → 4.5.9 | LOW patch bump 4.5.5 -> 4.5.9 | UPDATE — routine maintenance bump, low risk. | |
| Routine | headers-security-advanced-hsts-wp active | 5.0.44 → 5.3.5 | MEDIUM multi-minor jump 5.0.44 -> 5.3.5 (skipped 3 minor releases) | UPDATE — routine maintenance bump, low risk. | |
| Routine | leadin active | 11.3.69 → 11.3.73 | LOW patch bump 11.3.69 -> 11.3.73 | UPDATE — routine maintenance bump, low risk. | |
| Routine | molongui-authorship active | 5.2.9 → 5.2.12 | LOW patch bump 5.2.9 -> 5.2.12 | UPDATE — routine maintenance bump, low risk. | |
| Routine | nginx-helper active | 2.3.3 → 2.4.1 | MEDIUM minor version bump 2.3.3 -> 2.4.1 | UPDATE — routine maintenance bump, low risk. | |
| Routine | podcast-subscribe-buttons active | 1.5.2 → 1.5.5 | LOW patch bump 1.5.2 -> 1.5.5 | UPDATE — routine maintenance bump, low risk. | |
| Routine | redirection active | 5.5.2 → 5.10.0 | MEDIUM multi-minor jump 5.5.2 -> 5.10.0 (skipped 5 minor releases) | UPDATE — routine maintenance bump, low risk. | |
| Routine | side-cart-woocommerce active | 2.6.8 → 2.8.1 | MEDIUM minor version bump 2.6.8 -> 2.8.1 | UPDATE — routine maintenance bump, low risk. | |
| Routine | simple-author-box active | 2.58 → 2.61 | MEDIUM multi-minor jump 2.58 -> 2.61 (skipped 3 minor releases) | UPDATE — routine maintenance bump, low risk. | |
| Routine | woocommerce-services active | 3.6.12 → 3.6.16 | LOW patch bump 3.6.12 -> 3.6.16 | UPDATE — routine maintenance bump, low risk. | |
| Routine | woocommerce-payments active | 11.0.0 → 11.1.0 | MEDIUM minor version bump 11.0.0 -> 11.1.0 | UPDATE — routine maintenance bump, low risk. | |
| Routine | wp-mail-smtp active | 4.5.0 → 4.9.0 | MEDIUM multi-minor jump 4.5.0 -> 4.9.0 (skipped 4 minor releases) | UPDATE — routine maintenance bump, low risk. | |
| Routine | yaymail active | 4.4.2 → 4.4.4 | LOW patch bump 4.4.2 -> 4.4.4 | UPDATE — routine maintenance bump, low risk. | |
| Routine | wordpress-seo active | 28.2 → 28.5 | HIGH multi-minor jump 28.2 -> 28.5 (skipped 3 minor releases); HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE WITH CAPTURE — routine bump but on a sitewide-impact plugin; watch the diff closely. | |
| Routine | imagify inactive | 2.2.6 → 2.3.4 | MEDIUM minor version bump 2.2.6 -> 2.3.4 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. | |
| Routine | all-in-one-schemaorg-rich-snippets inactive | 1.7.4 → 1.7.9 | LOW patch bump 1.7.4 -> 1.7.9 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |