tag
Admin-Ajax
Critical
WP移行専用プラグイン for CPI <= 1.0.2 - Unauthenticated Arbitrary File Upload RCE (CVE-2025-11170)
CVE-2025-11170·
WP移行専用プラグイン for CPI (cpi-wp-migration, a CPI/site-migration import plugin for WordPress)
unpatched
Critical
Simple User Registration WordPress Plugin — Unauthenticated Privilege Escalation (CVE-2025-4334)
CVE-2025-4334·
"Simple User Registration" WordPress plugin (registration/form-builder plugin, wpr_submit_form AJAX action)
unpatched
Critical
Real Spaces WordPress Theme Unauthenticated Privilege Escalation via `imic_agent_register` (CVE-2025-6758)
CVE-2025-6758·
Real Spaces - Properties Directory Theme for WordPress (imic_agent_register AJAX handler)
unpatched
Critical
Opal Estate Pro WordPress Plugin Unauthenticated Administrator Registration (CVE-2025-6934)
CVE-2025-6934·
Opal Estate Pro (WordPress real-estate plugin)
unpatched
Medium
WordPress User Language Switch Plugin SSRF — CVE-2026-0745
CVE-2026-0745 (GHSA-m38c-5p3m-p7gm)·
WordPress "User Language Switch" plugin
unpatched
High
WordPress Ninja Forms Plugin Unauthenticated File Upload — CVE-2026-0740
CVE-2026-0740·
WordPress "Ninja Forms" plugin — file upload field/module
unpatched
High
WordPress Contest Gallery Plugin Unauthenticated Blind SQL Injection — CVE-2026-3180
CVE-2026-3180·
WordPress "Contest Gallery" plugin
unpatched
Critical
WordPress "Form Maker" Plugin Unauthenticated SQL Injection — CVE-2026-3359
CVE-2026-3359·
WordPress "Form Maker" plugin by Web10
unpatched
High
WordPress "Drag and Drop File Upload for Contact Form 7" Unauthenticated RCE — CVE-2026-5364
CVE-2026-5364·
WordPress plugin "Drag and Drop File Upload for Contact Form 7" (drag-and-drop-file-upload-for-contact-form-7)
unpatched
High
Perfmatters WordPress Plugin Arbitrary File Deletion (CVE-2026-4350)
CVE-2026-4350·
Perfmatters WordPress plugin
unpatched
Medium
Gravity Forms Unauthenticated Reflected XSS via `gform_get_config` `form_ids` Parameter (CVE-2026-4406)
CVE-2026-4406·
Gravity Forms (WordPress plugin) by Rocketgenius, Inc.
patched
Critical
BetterDocs Pro Unauthenticated Local File Inclusion to RCE — CVE-2026-7515
CVE-2026-7515·
BetterDocs Pro (WordPress plugin)
unpatched