norweststg.wpengine.com · WordPress 7.0.3 · theme brand-nav-child-theme · wpengine
| Priority | Plugin | Version | Advisory | Breaking risk | Recommendation |
|---|---|---|---|---|---|
| Critical CVE | advanced-custom-fields-pro active | 6.1.6 → 6.8.10 | CVE-2024-34762 CVSS 9.9 CRITICAL +13 more advisories | HIGH multi-minor jump 6.1.6 -> 6.8.10 (skipped 7 minor releases); HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE NOW — actively exploitable in the installed version. Do it even though blast radius is high; capture+rollback covers us. |
| Critical CVE | elementor active | 3.13.3 → 4.2.4 | CVE-2023-48777 CVSS 9.9 CRITICAL +27 more advisories | HIGH MAJOR version jump 3.13.3 -> 4.2.4 (API/behavior changes expected); HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE NOW — actively exploitable in the installed version. Do it even though blast radius is high; capture+rollback covers us. |
| Critical CVE | elementor-pro active | 3.13.2 → no fix available | CVE-2026-32475 CVSS 9.0 CRITICAL +11 more advisories | N/A no update available — nothing to upgrade to; HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | NO FIX AVAILABLE — vulnerable and the vendor has no newer version installed//licensed here. Options: confirm the licence is active (premium plugins stop offering updates when a key lapses), replace the plugin, or accept the risk deliberately. Do NOT ignore silently. |
| Critical CVE | better-search-replace inactive | 1.4.2 → 1.4.11 | CVE-2023-6933 CVSS 9.8 CRITICAL | LOW patch bump 1.4.2 -> 1.4.11 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| Critical CVE | jet-elements inactive | 2.6.9 → no fix available | CVE-2023-39157 CVSS 9.0 CRITICAL +16 more advisories | N/A no update available — nothing to upgrade to | NO FIX AVAILABLE — vulnerable and the vendor has no newer version installed//licensed here. Options: confirm the licence is active (premium plugins stop offering updates when a key lapses), replace the plugin, or accept the risk deliberately. Do NOT ignore silently. |
| Critical CVE | jet-smart-filters inactive | 3.1.1 → no fix available | CVE-2026-48875 CVSS 9.3 CRITICAL +7 more advisories | N/A no update available — nothing to upgrade to | NO FIX AVAILABLE — vulnerable and the vendor has no newer version installed//licensed here. Options: confirm the licence is active (premium plugins stop offering updates when a key lapses), replace the plugin, or accept the risk deliberately. Do NOT ignore silently. |
| Critical CVE | wp-file-manager inactive | 7.1.8 → 8.0.4 | CVE-2023-6825 CVSS 9.9 CRITICAL +5 more advisories | HIGH MAJOR version jump 7.1.8 -> 8.0.4 (API/behavior changes expected) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| Critical CVE | wp-server-stats inactive | 1.7.3 → 1.9.1 | CVE-2024-6297 CVSS 10.0 CRITICAL +1 more advisories | MEDIUM minor version bump 1.7.3 -> 1.9.1 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| High CVE | dynamic-content-for-elementor active | 2.9.4 → 2.10.6 | CVE-2023-52150 CVSS 8.8 HIGH | HIGH minor version bump 2.9.4 -> 2.10.6; HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | ewww-image-optimizer active | 7.0.0 → 8.7.7 | CVE-2026-84773 CVSS 7.2 HIGH +5 more advisories | HIGH MAJOR version jump 7.0.0 -> 8.7.7 (API/behavior changes expected) | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | wp-2fa active | 2.4.1 → 4.1.0 | CVE-2024-32568 CVSS 7.1 HIGH +6 more advisories | HIGH MAJOR version jump 2.4.1 -> 4.1.0 (API/behavior changes expected) | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | insert-headers-and-footers active | 2.0.11 → 2.3.9 | CVE-2026-8832 CVSS 8.8 HIGH +1 more advisories | MEDIUM multi-minor jump 2.0.11 -> 2.3.9 (skipped 3 minor releases) | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | woocommerce-ajax-filters inactive | 1.6.4.1 → 3.3 | CVE-2026-66439 CVSS 7.1 HIGH +2 more advisories | HIGH MAJOR version jump 1.6.4.1 -> 3.3 (API/behavior changes expected) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| High CVE | advanced-custom-fields inactive | 6.0.7 → 6.8.10 | CVE-2023-30777 CVSS 7.1 HIGH +12 more advisories | HIGH multi-minor jump 6.0.7 -> 6.8.10 (skipped 8 minor releases); HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| High CVE | advanced-database-cleaner inactive | 3.1.2 → 4.2.0 | CVE-2023-49764 CVSS 7.6 HIGH +3 more advisories | HIGH MAJOR version jump 3.1.2 -> 4.2.0 (API/behavior changes expected) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| High CVE | imagemagick-engine inactive | 1.7.7 → 2.0.0 | CVE-2024-6486 CVSS 7.2 HIGH | HIGH MAJOR version jump 1.7.7 -> 2.0.0 (API/behavior changes expected) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| High CVE | users-customers-import-export-for-wp-woocommerce inactive | 2.3.9 → 2.7.5 | CVE-2025-1970 CVSS 7.6 HIGH +7 more advisories | MEDIUM multi-minor jump 2.3.9 -> 2.7.5 (skipped 4 minor releases) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| High CVE | jetpack inactive | 12.0.1 → 16.2 | CVE-2023-2996 CVSS 8.8 HIGH +11 more advisories | HIGH MAJOR version jump 12.0.1 -> 16.2 (API/behavior changes expected) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| High CVE | jet-tricks inactive | 1.4.3 → no fix available | CVE-2023-48760 CVSS 8.2 HIGH +5 more advisories | N/A no update available — nothing to upgrade to | NO FIX AVAILABLE — vulnerable and the vendor has no newer version installed//licensed here. Options: confirm the licence is active (premium plugins stop offering updates when a key lapses), replace the plugin, or accept the risk deliberately. Do NOT ignore silently. |
| High CVE | password-protect-page inactive | 1.8.8 → 1.9.24 | CVE-2026-0551 CVSS 8.8 HIGH +9 more advisories | MEDIUM minor version bump 1.8.8 -> 1.9.24 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| High CVE | shortpixel-image-optimiser inactive | 5.2.1 → 6.5.6 | CVE-2024-48043 CVSS 7.6 HIGH +8 more advisories | HIGH MAJOR version jump 5.2.1 -> 6.5.6 (API/behavior changes expected) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| High CVE | timber-library inactive | 1.22.1 → 1.23.4 | CVE-2024-45411 CVSS 8.6 HIGH +1 more advisories | MEDIUM minor version bump 1.22.1 -> 1.23.4 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| High CVE | white-label-cms inactive | 2.5 → 2.7.14 | CVE-2024-43303 CVSS 7.1 HIGH +2 more advisories | MEDIUM minor version bump 2.5 -> 2.7.14 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| High CVE | wordpress-importer inactive | 0.8 → 0.9.6 | CVE-2024-13889 CVSS 7.2 HIGH | MEDIUM minor version bump 0.8 -> 0.9.6 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| High CVE | wp-all-import-pro inactive | 4.7.8 → no fix available | CVE-2024-9624 CVSS 7.6 HIGH +3 more advisories | N/A no update available — nothing to upgrade to | NO FIX AVAILABLE — vulnerable and the vendor has no newer version installed//licensed here. Options: confirm the licence is active (premium plugins stop offering updates when a key lapses), replace the plugin, or accept the risk deliberately. Do NOT ignore silently. |
| High CVE | wp-bulk-delete inactive | 1.2.4 → 1.4.4 | CVE-2024-47352 CVSS 7.1 HIGH +2 more advisories | MEDIUM minor version bump 1.2.4 -> 1.4.4 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| Med/Low CVE | query-monitor active | 3.12.3 → 4.0.7 | CVE-2026-4267 CVSS | HIGH MAJOR version jump 3.12.3 -> 4.0.7 (API/behavior changes expected) | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | search-filter-pro active | 2.5.14 → no fix available | CVE-2024-6481 CVSS 4.8 MEDIUM +1 more advisories | N/A no update available — nothing to upgrade to | No update offered for this version — likely an expired premium licence or a removed plugin. Worth a look. |
| Med/Low CVE | sticky-header-effects-for-elementor active | 1.6.5 → 2.2.2 | CVE-2025-58251 CVSS 4.3 MEDIUM | HIGH MAJOR version jump 1.6.5 -> 2.2.2 (API/behavior changes expected) | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | svg-support active | 2.5.5 → 2.6.1 | CVE-2024-10222 CVSS 6.4 MEDIUM +4 more advisories | MEDIUM minor version bump 2.5.5 -> 2.6.1 | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | wp-custom-taxonomy-image inactive | 1.0.0 → no fix available | CVE-2024-9591 CVSS 4.8 MEDIUM | N/A no update available — nothing to upgrade to | No update offered for this version — likely an expired premium licence or a removed plugin. Worth a look. |
| Med/Low CVE | custom-post-type-ui inactive | 1.13.4 → 1.19.3 | CVE-2023-1623 CVSS 6.5 MEDIUM +3 more advisories | MEDIUM multi-minor jump 1.13.4 -> 1.19.3 (skipped 6 minor releases) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| Med/Low CVE | dashboard-welcome-for-elementor inactive | 1.0.7 → 1.0.11 | CVE-2024-32110 CVSS 4.3 MEDIUM | LOW patch bump 1.0.7 -> 1.0.11 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| Med/Low CVE | genesis-blocks inactive | 1.5.4 → 3.1.11 | CVE-2024-2761 CVSS 6.8 MEDIUM +3 more advisories | HIGH MAJOR version jump 1.5.4 -> 3.1.11 (API/behavior changes expected) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| Med/Low CVE | limit-login-attempts-reloaded inactive | 2.25.13 → 3.3.8 | CVE-2023-6934 CVSS 5.4 MEDIUM +2 more advisories | HIGH MAJOR version jump 2.25.13 -> 3.3.8 (API/behavior changes expected) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| Med/Low CVE | make-column-clickable-elementor inactive | 1.4.0 → 1.6.2 | CVE-2025-59592 CVSS 0.0 | MEDIUM minor version bump 1.4.0 -> 1.6.2 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| Med/Low CVE | pojo-accessibility inactive | 2.1.0 → 4.1.4 | CVE-2026-25386 CVSS 5.3 MEDIUM +3 more advisories | HIGH MAJOR version jump 2.1.0 -> 4.1.4 (API/behavior changes expected) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| Med/Low CVE | post-type-switcher inactive | 3.2.1 → 4.0.1 | CVE-2025-12524 CVSS 5.4 MEDIUM | HIGH MAJOR version jump 3.2.1 -> 4.0.1 (API/behavior changes expected) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| Med/Low CVE | shortpixel-adaptive-images inactive | 3.7.1 → 3.11.6 | CVE-2026-57342 CVSS 6.5 MEDIUM +8 more advisories | MEDIUM multi-minor jump 3.7.1 -> 3.11.6 (skipped 4 minor releases) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| Med/Low CVE | remove-old-slugspermalinks inactive | 2.6.2 → no fix available | CVE-2024-30536 CVSS 4.3 MEDIUM | N/A no update available — nothing to upgrade to | No update offered for this version — likely an expired premium licence or a removed plugin. Worth a look. |
| Med/Low CVE | white-label inactive | 2.8.0 → 2.16.9 | CVE-2023-52128 CVSS 4.3 MEDIUM | MEDIUM multi-minor jump 2.8.0 -> 2.16.9 (skipped 8 minor releases) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| Med/Low CVE | wp-migrate-db inactive | 2.6.5 → 2.7.11 | CVE-2025-11427 CVSS 5.8 MEDIUM +1 more advisories | MEDIUM minor version bump 2.6.5 -> 2.7.11 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |
| Major version | https-redirection inactive | 1.9.1 → 2.0.1 | HIGH MAJOR version jump 1.9.1 -> 2.0.1 (API/behavior changes expected) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. | |
| Major version | online-active-users inactive | 1.2 → 3.4.4 | HIGH MAJOR version jump 1.2 -> 3.4.4 (API/behavior changes expected) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. | |
| Routine | admin-taxonomy-filter active | 1.0.2 → 1.0.5 | LOW patch bump 1.0.2 -> 1.0.5 | UPDATE — routine maintenance bump, low risk. | |
| Routine | child-theme-configurator active | 2.6.2 → 2.6.7 | LOW patch bump 2.6.2 -> 2.6.7 | UPDATE — routine maintenance bump, low risk. | |
| Routine | classic-editor active | 1.6.3 → 1.7.0 | MEDIUM minor version bump 1.6.3 -> 1.7.0 | UPDATE — routine maintenance bump, low risk. | |
| Routine | disable-json-api active | 1.7 → 1.8 | MEDIUM minor version bump 1.7 -> 1.8 | UPDATE — routine maintenance bump, low risk. | |
| Routine | duplicate-page active | 4.5.2 → 4.5.9 | LOW patch bump 4.5.2 -> 4.5.9 | UPDATE — routine maintenance bump, low risk. | |
| Routine | flying-pages active | 2.4.6 → 2.4.7 | LOW patch bump 2.4.6 -> 2.4.7 | UPDATE — routine maintenance bump, low risk. | |
| Routine | wp-revisions-control active | 1.4.3 → 1.4.4 | LOW patch bump 1.4.3 -> 1.4.4 | UPDATE — routine maintenance bump, low risk. | |
| Routine | admin-css-mu inactive | 2.8 → 2.10 | MEDIUM minor version bump 2.8 -> 2.10 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. | |
| Routine | advanced-post-queries inactive | 1.1.0 → 1.1.4 | LOW patch bump 1.1.0 -> 1.1.4 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. | |
| Routine | akismet inactive | 5.0.1 → 5.7.2 | MEDIUM multi-minor jump 5.0.1 -> 5.7.2 (skipped 7 minor releases) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. | |
| Routine | bulk-delete inactive | 6.0.2 → 6.12 | MEDIUM multi-minor jump 6.0.2 -> 6.12 (skipped 12 minor releases) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. | |
| Routine | cookie-law-info inactive | 3.0.8 → 3.5.6 | MEDIUM multi-minor jump 3.0.8 -> 3.5.6 (skipped 5 minor releases) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. | |
| Routine | headers-security-advanced-hsts-wp inactive | 5.0.21 → 5.3.5 | MEDIUM multi-minor jump 5.0.21 -> 5.3.5 (skipped 3 minor releases) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. | |
| Routine | regenerate-thumbnails inactive | 3.1.5 → 3.1.6 | LOW patch bump 3.1.5 -> 3.1.6 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. | |
| Routine | wp-widget-disable inactive | 3.0.0 → 3.0.1 | LOW patch bump 3.0.0 -> 3.0.1 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. | |
| Routine | wp-smartcrop inactive | 2.0.6 → 2.0.10 | LOW patch bump 2.0.6 -> 2.0.10 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |