Question False Positive? : Outdated or vulnerable software discovered - Action Required:

[johnmack]

Hi there,

I keep receiving the following security advisory on one of my sites

---

This message is to provide you important information regarding web server security. Please note that the following software in your environment is considered to be outdated or vulnerable:

• kadence version 1.5.2 that is located at /var/www/vhosts/thedomainname.com/httpdocs has vulnerability(s):
  • CVE-2026-28005
  • CVE-2025-39557
  • CVE-2025-54697
  • WPVDB-ID:39514705-C887-4A02-A77B-36E1DCCA8F5D

---

But the cve advisory linked is for

Kadence WooCommerce Email Designer < 1.5.7 - Admin+ PHP Objection Injection​

this site doesn't have that plugin installed, they have the kadence theme installed, where version 1.5.2 is the latest version.

Is this a wrong notification due to the term kadence being the name the theme and a plugin?

if so can it be resolved so i don't keep receiving an urgent advisory every couple of days please?

thanks
John