Question False Positive? : Outdated or vulnerable software discovered - Action Required:

[johnmack]

Hi there,

I keep receiving the following security advisory on one of my sites

---

This message is to provide you important information regarding web server security. Please note that the following software in your environment is considered to be outdated or vulnerable:

• kadence version 1.5.2 that is located at /var/www/vhosts/thedomainname.com/httpdocs has vulnerability(s):
  • CVE-2026-28005
  • CVE-2025-39557
  • CVE-2025-54697
  • WPVDB-ID:39514705-C887-4A02-A77B-36E1DCCA8F5D

---

But the cve advisory linked is for

Kadence WooCommerce Email Designer < 1.5.7 - Admin+ PHP Objection Injection​

this site doesn't have that plugin installed, they have the kadence theme installed, where version 1.5.2 is the latest version.

Is this a wrong notification due to the term kadence being the name the theme and a plugin?

if so can it be resolved so i don't keep receiving an urgent advisory every couple of days please?

thanks
John

 

[Sebahat.hadzhi]

Hi, John. As long as the plugin in question is indeed not installed on your website, this is very likely a false-positive flag. If I am not mistaken, this notification originates from Imunify, I would suggest opening a ticket with Plesk support so they can involve the Imunify team for further review. If you don't have Plesk support included in your license, please consider reporting the case directly to CloudLinux.