galileostg1.wpenginepowered.com · WordPress 7.0.4 · theme theme · wpengine
| Priority | Plugin | Version | Advisory | Breaking risk | Recommendation |
|---|---|---|---|---|---|
| Critical CVE | translatepress-multilingual active | 2.8.9 → 3.3.6 | CVE-2026-78267 CVSS 9.8 CRITICAL +9 more advisories | HIGH MAJOR version jump 2.8.9 -> 3.3.6 (API/behavior changes expected) | UPDATE NOW — actively exploitable in the installed version. Do it even though blast radius is high; capture+rollback covers us. |
| High CVE | gravityforms active | 2.10.4 → 3.1.1 | CVE-2026-19513 CVSS 8.1 HIGH +2 more advisories | HIGH MAJOR version jump 2.10.4 -> 3.1.1 (API/behavior changes expected); HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | popup-maker active | 1.20.2 → 1.25.0 | CVE-2026-8848 CVSS 7.2 HIGH +5 more advisories | MEDIUM multi-minor jump 1.20.2 -> 1.25.0 (skipped 5 minor releases) | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | wp-smushit active | 3.16.6 → 4.3.3 | CVE-2026-81285 CVSS 7.5 HIGH +2 more advisories | HIGH MAJOR version jump 3.16.6 -> 4.3.3 (API/behavior changes expected) | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | wordpress-importer active | 0.8.3 → 0.9.6 | CVE-2024-13889 CVSS 7.2 HIGH | MEDIUM minor version bump 0.8.3 -> 0.9.6 | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | insert-headers-and-footers active | 2.2.3.1 → 2.3.9 | CVE-2026-8832 CVSS 8.8 HIGH | MEDIUM minor version bump 2.2.3.1 -> 2.3.9 | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| Med/Low CVE | acf-to-rest-api active | 3.3.3 → no fix available | CVE-2025-62979 CVSS 5.3 MEDIUM +1 more advisories | N/A no update available — nothing to upgrade to | No update offered for this version — likely an expired premium licence or a removed plugin. Worth a look. |
| Med/Low CVE | complianz-gdpr active | 7.1.5 → 7.5.5 | CVE-2025-11185 CVSS 6.4 MEDIUM +5 more advisories | MEDIUM multi-minor jump 7.1.5 -> 7.5.5 (skipped 4 minor releases) | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | limit-login-attempts-reloaded active | 2.26.16 → 3.3.8 | CVE-2026-18356 CVSS 3.7 LOW | HIGH MAJOR version jump 2.26.16 -> 3.3.8 (API/behavior changes expected) | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | smtp2go active | 1.10.0 → 1.17.1 | CVE-2025-54011 CVSS 4.3 MEDIUM +1 more advisories | MEDIUM multi-minor jump 1.10.0 -> 1.17.1 (skipped 7 minor releases) | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | sucuri-scanner active | 1.9.6 → 2.8 | CVE-2026-73033 CVSS 6.5 MEDIUM | HIGH MAJOR version jump 1.9.6 -> 2.8 (API/behavior changes expected) | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | two-factor-2fa-via-email active | 1.9.5 → 1.9.10 | CVE-2025-13587 CVSS 6.5 MEDIUM | LOW patch bump 1.9.5 -> 1.9.10 | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | duplicate-post active | 4.5 → 4.7 | CVE-2026-53740 CVSS 5.4 MEDIUM +2 more advisories | MEDIUM minor version bump 4.5 -> 4.7 | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Major version | change-admin-email-setting-without-outbound-email active | 4.1 → 5.0 | HIGH MAJOR version jump 4.1 -> 5.0 (API/behavior changes expected) | HOLD / STAGE FIRST — major jump on a high-blast-radius plugin with no security pressure. Recommend testing on a staging twin before prod. | |
| Major version | better-wp-security active | 9.3.5 → 10.0.3 | HIGH MAJOR version jump 9.3.5 -> 10.0.3 (API/behavior changes expected); HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | HOLD / STAGE FIRST — major jump on a high-blast-radius plugin with no security pressure. Recommend testing on a staging twin before prod. | |
| Routine | advanced-custom-fields-pro active | 6.3.11 → 6.8.10 | HIGH multi-minor jump 6.3.11 -> 6.8.10 (skipped 5 minor releases); HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE WITH CAPTURE — routine bump but on a sitewide-impact plugin; watch the diff closely. | |
| Routine | akismet active | 5.3.5 → 5.7.2 | MEDIUM multi-minor jump 5.3.5 -> 5.7.2 (skipped 4 minor releases) | UPDATE — routine maintenance bump, low risk. | |
| Routine | force-regenerate-thumbnails active | 2.2.1 → 2.3.0 | MEDIUM minor version bump 2.2.1 -> 2.3.0 | UPDATE — routine maintenance bump, low risk. | |
| Routine | headers-security-advanced-hsts-wp active | 5.0.41 → 5.3.5 | MEDIUM multi-minor jump 5.0.41 -> 5.3.5 (skipped 3 minor releases) | UPDATE — routine maintenance bump, low risk. | |
| Routine | redirection active | 5.5.0 → 5.10.0 | MEDIUM multi-minor jump 5.5.0 -> 5.10.0 (skipped 5 minor releases) | UPDATE — routine maintenance bump, low risk. | |
| Routine | simple-page-ordering active | 2.7.2 → 2.8.0 | MEDIUM minor version bump 2.7.2 -> 2.8.0 | UPDATE — routine maintenance bump, low risk. | |
| Routine | autodescription active | 5.0.6 → 5.1.4 | MEDIUM minor version bump 5.0.6 -> 5.1.4 | UPDATE — routine maintenance bump, low risk. | |
| Routine | translatepress-developer active | 1.4.8 → 1.8.7 | MEDIUM multi-minor jump 1.4.8 -> 1.8.7 (skipped 4 minor releases) | UPDATE — routine maintenance bump, low risk. | |
| Routine | wp-mail-smtp inactive | 4.2.0 → 4.9.0 | MEDIUM multi-minor jump 4.2.0 -> 4.9.0 (skipped 7 minor releases) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |