In addition to the regular feature and product patches typically released, there were a few updates of note last month that may be applicable to your site including:
Updates & Improvements, and Ongoing Issues:
1) WordPress Security Updates with version 7.1.1 & 7.1.2: In September, WordPress released two patches for WordPress Core, each to plug a number of security issues discovered in WordPress 7 as well as previous releases.
These updates patched unauthenticated stored cross-site scripting (XSS) issues, closed holes for maliciously crafted URLs, patched information disclosure issues and authenticated path traversal issues, XML-RPC issue allowing changeset posts to bypass the custom CSS capability check, and misc. multisite and other issues. Both releases were installed on our WordPress Care Plan client sites less than 24 hours after release. For more details on the updates as well as the specific flaws patched, you may visit the following links:
https://wordpress.org/documentation/wordpress-version/version-7-1-1/
https://wordpress.org/documentation/wordpress-version/version-7-1-2/
2) WooCommerce 11.0.0 was released in August, followed by 11.1+ in September: This new release brought with it improved performance for stores with large catalogs, much improved Guest Checkout process allowing customers to find and link previous guest orders to their account, more reliable analytics reporting, plus a number of new experimental features like Abandoned Cart emails, block-based email editing, and a new Settings UI.
With the exception of experimental features, all Care Plan client sites have been upgraded to version 11 and higher and can begin benefiting from these updates. For more on WooCommerce 11.0.0, please visit: https://developer.woocommerce.com/2026/08/04/woocommerce-11-0/
3) A Note on Breaking Changes: You may notice notes in the Plugin Update Summary marked “Breaking Changes”. While generally okay to install, these types of updates are known to cause issues for websites under specific circumstances. The Gravity Forms Stripe plugin is a great example of that. Another is the plugin, PostSMTP. In each case, you may find that these plugins are not being updated on your site. It’s not because I’m ignoring them. Rather, these types of plugins undergo more rigorous testing on my part and, in some cases, slower roll outs as I ensure things work as expected. Rest assured, I will install the updates as soon as they’ve been fully vetted.
4) Ongoing Divi 5 Update Information: Though new client sites are being configured with Divi 5, existing client sites will remain on Divi 4 for now as I begin migrating to the final release on selected sites to determine if any compatibility issues arise. I am finding the interface changes are significant enough and enough compatibility issues remain that I’m “playing it safe” and slowing down the roll-out for now. Stay tuned for more updates!
Security-related Patches in the month of September:
- Elementor security patches were released in September
- Gravity Forms included security hardening patches in 3.1.1
- Routine feature and Usability updates were made with the release of Defender Pro 6.2.3-6.3.0 and Wordfence 9.0.1
- Security patches of note were applied to Sugar Calendar, JetPack, The Events Calendar, Advanced Custom Fields, NextGen Gallery, Simple CAPTCHA, and the maintenance plugins used by our Care Plans: Smush Pro and Branda Pro.
All security patches and affected plugins, including some listed in the overview below, are generally installed via your Care Plan within 12-48 hours of an update becoming available depending upon the severity of the patch.
Plugin Update Summary for September 2026:
WordPress Core
7.1.1 & 7.1.2 (security patches)
Security-Related Updates
WordPress 7.1.1/7.1.2
Wordfence 9.0.1
Defender Pro 6.2.3/6.2.4/6.3.0
Elementor 4.2.4/4.3.2
Essential Addons for Elementor 6.8.5
Redux Framework 4.5.14/4.5.15
Woo Tax 3.6.15
Gravity Forms 3.1.1
Sugar Calendar 3.14.0
Smush Pro 4.3.4
Branda Pro 3.4.33
JetPack 16.1.3
The Events Calendar 6.17.4/6.17.4.1/6.17.5
Advanced Custom Fields (ACF) 6.8.10
Simple CAPTCHA Alt 1.42.3/1.43.0/1.43.1/1.43.2/1.44.0
NextGen Gallery 4.5.0/4.5.1
Publish Press Permissions 4.8.4
MC4WP 4.14.1
Tickera 3.6.0.4/3.6.0.5/3.6.0.6
Responsive LightboxGallery 2.7.9
Strong Testimonials 3.3.9/3.3.12
Standard Plugins
Smush Pro 4.3.3/4.3.4
Branda Pro 3.4.32/3.4.33
Gravity Forms 3.1.1
GF Stripe Add On 7.0.0 (Breaking Changes)
GF Constant Contact 1.8.1
GP Advanced Calculations 2.0.6/2.0.7
GP File Upload 1.5.15
GP Populate Anything 2.1.76/2.1.77
Post SMTP 4.0.2
Spellbook 3.0.30/3.0.31
Sugar Calendar 3.14.0
The Events Calendar 6.17.4/6.17.4.1/6.17.5
Yoast 28.5/28.6
JetPack 16.1.3
Advanced Custom Fields (ACF) 6.8.10
Envira Gallery 1.17.0
NextGen Gallery 4.4.1/4.5.0/4.5.1
UpdraftPlus 1.26.8
Strong Testimonials 3.3.11/3.3.12
WP Optimize 4.7.0
Responsive LightboxGallery 2.7.9
RSS Retriever Lite 1.3.0
Google Analytics for WordPress 11.3.0
CookieYes 3.5.6
Publish Press Permissions 4.8.4/4.9.0
MC4WP 4.14.1
Embed Plus for YouTube Gallery 14.2.6.1
Smash Ball YouTube Feed 2.9.0
CMB2 2.13.0/2.13.1
Strong Testimonials 3.3.7/3.3.8/3.3.9/3.3.10
Simple Sitemap 3.8.0/3.9.2
Themes and Related Plugins
Divi Mega Pro 1.9.9.9/1.9.10/1.9.11/1.9.12
Elementor 4.2.4/4.3.0/4.3.1/4.3.2
Astra (Elementor Theme) 4.13.12/4.14.0
Essential Addons for Elementor 6.8.3/6.8.4/6.8.5
Ultimate Addons for Elementor 2.9.5
Redux Framework 4.5.14/4.5.15
WooCommerce-Related
WooCommerce 11.1.0/11.1.1
Woo Smart Coupons 9.82.1
Woo Product Add-Ons 8.4.2
Flexible Shipping 6.12.4/6.13.0/6.13.1
Flexible Shipping Pro 4.1.1/4.1.2
Woo Shipping 2.3.16/2.4.0/2.4.1
Woo Tax 3.6.14/3.6.15/3.6.16/3.7.0
PDF Inv & Packing List 5.16.2/5.16.3
Woo Square 5.5.1
WooPayments 11.1.0
Google for WooCommerce 3.9.2/3.9.3/3.9.4
Tickera 3.6.0.4/3.6.0.5/3.6.0.6
Tickera Bridge 1.7.8
YITH Sequential Ord Numb 1.59.0