p1hdev.wpenginepowered.com · WordPress 7.0.4 · theme bootscore-child · wpengine
| Priority | Plugin | Version | Advisory | Breaking risk | Recommendation |
|---|---|---|---|---|---|
| High CVE | mainwp-child active | 5.4.0.1 → 6.2 | CVE-2026-27366 CVSS 7.5 HIGH | HIGH MAJOR version jump 5.4.0.1 -> 6.2 (API/behavior changes expected) | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| High CVE | insert-headers-and-footers active | 2.2.6 → 2.3.9 | CVE-2026-8832 CVSS 8.8 HIGH | MEDIUM minor version bump 2.2.6 -> 2.3.9 | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| Med/Low CVE | contact-form-7 active | 6.0.4 → 6.1.7 | CVE-2025-3247 CVSS 5.3 MEDIUM | MEDIUM minor version bump 6.0.4 -> 6.1.7 | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | flamingo active | 2.5 → 2.6.4 | CVE-2026-12853 CVSS 5.4 MEDIUM | MEDIUM minor version bump 2.5 -> 2.6.4 | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | stop-user-enumeration active | 1.6.3 → 1.7.8 | CVE-2025-4302 CVSS 5.3 MEDIUM | MEDIUM minor version bump 1.6.3 -> 1.7.8 | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | wp-file-manager active | 8.0.1 → 8.0.4 | CVE-2026-6382 CVSS | LOW patch bump 8.0.1 -> 8.0.4 | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | duplicate-post active | 4.5 → 4.7 | CVE-2026-53740 CVSS 5.4 MEDIUM +2 more advisories | MEDIUM minor version bump 4.5 -> 4.7 | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | wordpress-seo active | 24.6 → 28.5 | CVE-2025-14481 CVSS 4.3 MEDIUM +3 more advisories | HIGH MAJOR version jump 24.6 -> 28.5 (API/behavior changes expected); HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Major version | prevent-browser-caching active | 2.3.5 → 3.2.1 | HIGH MAJOR version jump 2.3.5 -> 3.2.1 (API/behavior changes expected) | HOLD / STAGE FIRST — major jump on a high-blast-radius plugin with no security pressure. Recommend testing on a staging twin before prod. | |
| Routine | advanced-custom-fields-pro active | 6.3.12 → 6.8.10 | HIGH multi-minor jump 6.3.12 -> 6.8.10 (skipped 5 minor releases); HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE WITH CAPTURE — routine bump but on a sitewide-impact plugin; watch the diff closely. | |
| Routine | cookie-law-info active | 3.2.8 → 3.5.6 | MEDIUM multi-minor jump 3.2.8 -> 3.5.6 (skipped 3 minor releases) | UPDATE — routine maintenance bump, low risk. | |
| Routine | font-awesome active | 5.0.1 → 5.2.1 | MEDIUM minor version bump 5.0.1 -> 5.2.1 | UPDATE — routine maintenance bump, low risk. | |
| Routine | megamenu active | 3.4.1 → 3.10.8 | MEDIUM multi-minor jump 3.4.1 -> 3.10.8 (skipped 6 minor releases) | UPDATE — routine maintenance bump, low risk. | |
| Routine | redirection active | 5.5.2 → 5.10.0 | MEDIUM multi-minor jump 5.5.2 -> 5.10.0 (skipped 5 minor releases) | UPDATE — routine maintenance bump, low risk. | |
| Routine | safe-svg active | 2.3.1 → 2.5.0 | MEDIUM minor version bump 2.3.1 -> 2.5.0 | UPDATE — routine maintenance bump, low risk. | |
| Routine | disable-wp-rest-api inactive | 2.6.4 → 2.6.9 | LOW patch bump 2.6.4 -> 2.6.9 | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. | |
| Routine | headers-security-advanced-hsts-wp inactive | 5.0.42 → 5.3.5 | MEDIUM multi-minor jump 5.0.42 -> 5.3.5 (skipped 3 minor releases) | UPDATE — plugin is INACTIVE, near-zero front-end risk. Safe to batch. |