Admin-Ajax

WP移行専用プラグイン for CPI <= 1.0.2 - Unauthenticated Arbitrary File Upload RCE (CVE-2025-11170) newCVE-2025-11170webCRITICAL 9.8Unpatched2026-07-06Simple User Registration WordPress Plugin — Unauthenticated Privilege Escalation (CVE-2025-4334) newCVE-2025-4334webCRITICAL 9.8Unverified2026-07-06Real Spaces WordPress Theme Unauthenticated Privilege Escalation via `imic_agent_register` (CVE-2025-6758) newCVE-2025-6758webCRITICAL 9.8Unverified2026-07-06Opal Estate Pro WordPress Plugin Unauthenticated Administrator Registration (CVE-2025-6934) new EPSS 25%CVE-2025-6934webCRITICAL 9.8Unverified2026-07-06WordPress User Language Switch Plugin SSRF — CVE-2026-0745 newCVE-2026-0745webMEDIUMUnverified2026-07-05WordPress Ninja Forms Plugin Unauthenticated File Upload — CVE-2026-0740 new EPSS 63%CVE-2026-0740webHIGHUnverified2026-07-05WordPress Contest Gallery Plugin Unauthenticated Blind SQL Injection — CVE-2026-3180 newCVE-2026-3180webHIGHUnverified2026-07-05WordPress "Form Maker" Plugin Unauthenticated SQL Injection — CVE-2026-3359 newCVE-2026-3359webCRITICALUnverified2026-07-05WordPress "Drag and Drop File Upload for Contact Form 7" Unauthenticated RCE — CVE-2026-5364 newCVE-2026-5364webHIGH 8.1Unverified2026-07-05Perfmatters WordPress Plugin Arbitrary File Deletion (CVE-2026-4350) newCVE-2026-4350webHIGH 8.1Unverified2026-07-05Gravity Forms Unauthenticated Reflected XSS via `gform_get_config` `form_ids` Parameter (CVE-2026-4406) newCVE-2026-4406webMEDIUM 6.1Patched2026-07-05BetterDocs Pro Unauthenticated Local File Inclusion to RCE — CVE-2026-7515 newCVE-2026-7515webCRITICAL 9.8Unverified2026-07-05