Follow up email plug-in update

Hi there, I received a notification that one of our clients sites has a vulnerability due to this plug-in. We explored it further and apparently it’s because it’s using an outdated version: 4.9.38. However, we’re not getting any notification in wp-admin that the plug-in needs to be updated so we had no idea. We’ll go ahead and manually update it using the latest zip file, however, do you know why this is happening? And how we can prevent it from happening again?

Thanks so much in advance!