paclinedev.wpenginepowered.com · WordPress 7.0.4 · theme bootscore-child · wpengine
| Priority | Plugin | Version | Advisory | Breaking risk | Recommendation |
|---|---|---|---|---|---|
| High CVE | insert-headers-and-footers active | 2.3.5 → 2.3.9 | CVE-2026-8832 CVSS 8.8 HIGH | LOW patch bump 2.3.5 -> 2.3.9 | UPDATE THIS RUN — known high-severity CVE hits this exact version. |
| Med/Low CVE | admin-site-enhancements active | 8.6.1 → 9.1.2 | CVE-2026-12083 CVSS +1 more advisories | HIGH MAJOR version jump 8.6.1 -> 9.1.2 (API/behavior changes expected) | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | flamingo active | 2.6.1 → 2.6.4 | CVE-2026-12853 CVSS 5.4 MEDIUM | LOW patch bump 2.6.1 -> 2.6.4 | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | smtp2go active | 1.14.1 → 1.17.1 | CVE-2026-7621 CVSS 4.3 MEDIUM | MEDIUM multi-minor jump 1.14.1 -> 1.17.1 (skipped 3 minor releases) | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Med/Low CVE | wordpress-seo active | 27.3 → 28.5 | CVE-2026-15425 CVSS | HIGH MAJOR version jump 27.3 -> 28.5 (API/behavior changes expected); HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE — real but lower-severity CVE. Low urgency, still worth clearing. |
| Routine | advanced-custom-fields-pro active | 6.8.0.1 → 6.8.10 | HIGH patch bump 6.8.0.1 -> 6.8.10; HIGH BLAST RADIUS plugin — touches page rendering / forms / cache sitewide | UPDATE WITH CAPTURE — routine bump but on a sitewide-impact plugin; watch the diff closely. | |
| Routine | contact-form-7 active | 6.1.5 → 6.1.7 | LOW patch bump 6.1.5 -> 6.1.7 | UPDATE — routine maintenance bump, low risk. | |
| Routine | headers-security-advanced-hsts-wp active | 5.3.2 → 5.3.5 | LOW patch bump 5.3.2 -> 5.3.5 | UPDATE — routine maintenance bump, low risk. | |
| Routine | view-transitions active | 1.2.0 → 1.2.1 | LOW patch bump 1.2.0 -> 1.2.1 | UPDATE — routine maintenance bump, low risk. |