norwestdev1.wpenginepowered.com · WordPress 7.0.4 · theme brand-nav-child-theme · wpengine
| Priority | Plugin | Version | Advisory | Breaking risk | Recommendation |
|---|---|---|---|---|---|
| High CVE | ewww-image-optimizer active | 8.7.5 → 8.7.7 | CVE-2026-84773 CVSS 7.2 HIGH | LOW patch bump 8.7.5 -> 8.7.7 | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | one-user-avatar active | 2.5.4 → 2.5.6 | CVE-2026-18983 CVSS 7.5 HIGH | LOW patch bump 2.5.4 -> 2.5.6 | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | revslider active | 6.7.18 → no fix available | CVE-2026-6692 CVSS 8.8 HIGH +8 more advisories | N/A no update available — nothing to upgrade to; HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | NO FIX AVAILABLE — vulnerable and the vendor has no newer version installed//licensed here. Options: confirm the licence is active (premium plugins stop offering updates when a key lapses), replace the plugin, or accept the risk deliberately. Do NOT ignore silently. |
| Med/Low CVE | search-filter-pro active | 2.5.14 → no fix available | CVE-2024-6481 CVSS 4.8 MEDIUM +1 more advisories | N/A no update available — nothing to upgrade to | No update offered for this version — likely an expired premium licence or a removed plugin. Worth a look. |
| Med/Low CVE | simple-cloudflare-turnstile active | 1.42.1 → 1.43.1 | CVE-2026-66632 CVSS 6.5 MEDIUM +2 more advisories | MEDIUM minor version bump 1.42.1 -> 1.43.1 | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | wordpress-seo-premium active | 24.8 → no fix available | CVE-2026-10821 CVSS 6.6 MEDIUM +1 more advisories | N/A no update available — nothing to upgrade to | No update offered for this version — likely an expired premium licence or a removed plugin. Worth a look. |
| Med/Low CVE | metasync inactive | 2.6.22 → 2.6.26 | CVE-2026-15247 CVSS | LOW patch bump 2.6.22 -> 2.6.26 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| Routine | admin-site-enhancements active | 9.0.1 → 9.1.2 | MEDIUM minor version bump 9.0.1 -> 9.1.2 | UPDATE — routine maintenance bump, low risk. | |
| Routine | advanced-custom-fields-pro active | 6.8.3 → 6.8.10 | HIGH patch bump 6.8.3 -> 6.8.10; HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE WITH CAPTURE — routine bump but on a sitewide-impact plugin; watch the diff closely. | |
| Routine | tinymce-advanced active | 5.9.2 → 5.10.1 | MEDIUM minor version bump 5.9.2 -> 5.10.1 | UPDATE — routine maintenance bump, low risk. | |
| Routine | am-lottieplayer active | 4.0.0 → 4.1.1 | MEDIUM minor version bump 4.0.0 -> 4.1.1 | UPDATE — routine maintenance bump, low risk. | |
| Routine | amplifi-plugins active | 3.3.2 → 3.3.7 | LOW patch bump 3.3.2 -> 3.3.7 | UPDATE — routine maintenance bump, low risk. | |
| Routine | cookie-law-info active | 3.5.4 → 3.5.6 | LOW patch bump 3.5.4 -> 3.5.6 | UPDATE — routine maintenance bump, low risk. | |
| Routine | dynamic-content-for-elementor active | 3.4.12 → 3.4.13 | HIGH patch bump 3.4.12 -> 3.4.13; HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE WITH CAPTURE — routine bump but on a sitewide-impact plugin; watch the diff closely. | |
| Routine | elementor active | 4.2.3 → 4.2.4 | HIGH patch bump 4.2.3 -> 4.2.4; HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE WITH CAPTURE — routine bump but on a sitewide-impact plugin; watch the diff closely. | |
| Routine | elementor-pro active | 4.2.2 → 4.2.3 | HIGH patch bump 4.2.2 -> 4.2.3; HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE WITH CAPTURE — routine bump but on a sitewide-impact plugin; watch the diff closely. | |
| Routine | headers-security-advanced-hsts-wp active | 5.3.4 → 5.3.5 | LOW patch bump 5.3.4 -> 5.3.5 | UPDATE — routine maintenance bump, low risk. | |
| Routine | mainwp-child active | 6.1.7 → 6.2 | MEDIUM minor version bump 6.1.7 -> 6.2 | UPDATE — routine maintenance bump, low risk. | |
| Routine | search-exclude active | 2.6.5 → 2.6.6 | LOW patch bump 2.6.5 -> 2.6.6 | UPDATE — routine maintenance bump, low risk. | |
| Routine | simple-banner active | 3.3.1 → 3.3.2 | LOW patch bump 3.3.1 -> 3.3.2 | UPDATE — routine maintenance bump, low risk. | |
| Routine | wp-security-audit-log active | 5.6.5 → 5.6.6 | LOW patch bump 5.6.5 -> 5.6.6 | UPDATE — routine maintenance bump, low risk. | |
| Routine | insert-headers-and-footers active | 2.3.8 → 2.3.9 | LOW patch bump 2.3.8 -> 2.3.9 | UPDATE — routine maintenance bump, low risk. | |
| Routine | wordpress-seo active | 28.3 → 28.5 | HIGH minor version bump 28.3 -> 28.5; HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE WITH CAPTURE — routine bump but on a sitewide-impact plugin; watch the diff closely. | |
| Routine | melapress-login-security inactive | 2.3.0 → 2.4.0 | MEDIUM minor version bump 2.3.0 -> 2.4.0 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. | |
| Routine | simply-static inactive | 3.8.11 → 3.8.13 | LOW patch bump 3.8.11 -> 3.8.13 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |