Ninjateam
33 CVEs across 25 Ninjateam products. Browse Ninjateam vulnerabilities, severities, and proof-of-concept exploits.
Ninjateam products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-1104 | High | 8.8 | 2026-02-12 | The FastDup – Fastest WordPress Migration & Duplicator plugin for WordPress is vulnerable to unauthorized backup creation and download due to a missing capabil… |
CVE-2025-14001 | Medium | 5.4 | 2026-01-13 | The WP Duplicate Page plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'duplicateBulkHandle' and… |
CVE-2026-0604 | Medium | 6.5 | 2026-01-06 | The FastDup – Fastest WordPress Migration & Duplicator plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.7 via the '… |
CVE-2025-66134 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in NinjaTeam FileBird Pro filebird-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2025-12900 | Medium | 4.3 | 2025-12-15 | The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to missing authorization in all versions up to, and including… |
CVE-2025-12481 | Medium | 4.3 | 2025-11-18 | The WP Duplicate Page plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.7. This is due to the plugin not prop… |
CVE-2025-11510 | Medium | 4.3 | 2025-10-18 | The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabili… |
CVE-2025-0818 | Medium | 6.5 | 2025-08-13 | Several WordPress plugins using elFinder versions 2.1.64 and prior are vulnerable to Directory Traversal in various versions. This makes it possible for unauth… |
CVE-2025-6986 | Medium | 6.5 | 2025-08-06 | The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to SQL Injection via the 'search' parameter in all versions up… |
CVE-2025-3234 | High | 7.2 | 2025-06-14 | The File Manager Pro – Filester plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and inc… |
CVE-2025-5236 | Medium | 6.4 | 2025-05-30 | The NinjaTeam Chat for Telegram plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘username’ parameter in all versions up to, and inclu… |
CVE-2025-1672 | Medium | 5.5 | 2025-03-06 | The Notibar – Notification Bar for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and in… |
CVE-2025-26977 | Low | 3.8 | 2025-02-25 | Authorization Bypass Through User-Controlled Key vulnerability in Ninja Team Filebird filebird allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-24591 | Medium | 4.3 | 2025-01-24 | Missing Authorization vulnerability in Ninja Team GDPR CCPA Compliance Support ninja-gdpr-compliance allows Exploiting Incorrectly Configured Access Control Se… |
CVE-2024-11885 | Medium | 6.4 | 2024-12-24 | The NinjaTeam Chat for Telegram plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'njtele_button shortcode in all versions up… |
CVE-2024-12331 | Medium | 4.3 | 2024-12-19 | The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_install_… |
CVE-2024-11012 | Medium | 6.3 | 2024-12-13 | The The Notibar – Notification Bar for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via njt_nofi_text AJAX action in all versi… |
CVE-2023-25966 | Medium | 5.5 | 2024-12-09 | Missing Authorization vulnerability in Ninja Team Filebird allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Filebird… |
CVE-2024-53825 | Medium | 4.7 | 2024-12-06 | Missing Authorization vulnerability in Ninja Team Filebird filebird allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2024-9669 | High | 7.2 | 2024-11-28 | The File Manager Pro – Filester plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to, and including, 1.8.5 via the 'fm_l… |
CVE-2024-8066 | High | 7.5 | 2024-11-28 | The File Manager Pro – Filester plugin for WordPress is vulnerable to arbitrary file uploads due to missing validation in the 'fsConnector' function in all ver… |
CVE-2024-10533 | Medium | 4.3 | 2024-11-16 | The WP Chat App plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the ajax_install_plugin() function… |
CVE-2024-10055 | Medium | 6.4 | 2024-10-18 | The Click to Chat – WP Support All-in-One Floating Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpsaio_snapchat sh… |
CVE-2024-49281 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Ninja Team Click to Chat – WP Support All-in-One Fl… |
CVE-2024-47331 | Critical | 9.3 | 2024-10-11 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ninja Team Multi Step for Contact Form cf7-multi-step all… |
CVE-2024-6617 | Medium | 4.8 | 2024-09-13 | The NinjaTeam Header Footer Custom Code WordPress plugin before 1.2 does not sanitise and escape some of its settings, which could allow high privilege users s… |
CVE-2024-6493 | Medium | 4.8 | 2024-09-13 | The NinjaTeam Header Footer Custom Code WordPress plugin before 1.2 does not sanitise and escape some of its settings, which could allow high privilege users s… |
CVE-2024-7031 | High | 7.5 | 2024-08-03 | The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'njt_fs_saveSe… |
CVE-2024-4664 | Medium | 4.8 | 2024-06-27 | The WP Chat App WordPress plugin before 3.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admins to perfo… |
CVE-2024-5607 | Medium | 5.4 | 2024-06-07 | The GDPR CCPA Compliance & Cookie Consent Banner plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on s… |
CVE-2024-35166 | Medium | 5.3 | 2024-05-14 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ninja Team Filebird.This issue affects Filebird: from n/a through 5.6.3. |
CVE-2024-2346 | Medium | 5.4 | 2024-05-02 | The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and… |
CVE-2024-2345 | Medium | 6.4 | 2024-05-02 | The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the folder name parameter i… |
CVE-2024-2837 | Medium | 5.4 | 2024-04-26 | The WP Chat App WordPress plugin before 3.6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admins to perfo… |
CVE-2024-2513 | Medium | 6.4 | 2024-04-09 | The WP Chat App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'imageAlt' block attribute in all versions up to, and including, 3.6… |
CVE-2024-29103 | High | 7.1 | 2024-03-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NinjaTeam Database for Contact Form 7 allows Stored XSS.T… |
CVE-2024-1761 | Medium | 6.4 | 2024-03-07 | The WP Chat App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget/block in all versions up to, and including, 3.6.1 due… |
CVE-2023-51370 | Medium | 5.9 | 2024-02-12 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NinjaTeam WP Chat App allows Stored XSS.This issue affect… |
CVE-2024-0691 | Medium | 5.5 | 2024-02-05 | The FileBird plugin for WordPress is vulnerable to Stored Cross-Site Scripting via imported folder titles in all versions up to, and including, 5.5.8.1 due to… |
CVE-2023-6592 | Medium | 5.3 | 2024-01-16 | The FastDup WordPress plugin before 2.2 does not prevent directory listing in sensitive directories containing export files. |
CVE-2023-51406 | Medium | 5.3 | 2024-01-08 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ninja Team FastDup – Fastest WordPress Migration & Duplicator.This issue affects Fa… |
CVE-2023-5740 | Medium | 6.4 | 2023-10-25 | The Live Chat with Facebook Messenger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'messenger' shortcode in all versions… |
CVE-2023-4862 | Medium | 4.8 | 2023-10-16 | The File Manager Pro WordPress plugin before 1.8.1 does not adequately validate and escape some inputs, leading to XSS by high-privilege users. |
CVE-2023-4861 | High | 7.2 | 2023-10-16 | The File Manager Pro WordPress plugin before 1.8.1 allows admin users to upload arbitrary files, even in environments where such a user should not be able to g… |
CVE-2023-4827 | High | 8.8 | 2023-10-16 | The File Manager Pro WordPress plugin before 1.8 does not properly check the CSRF nonce in the `fs_connector` AJAX action. This allows attackers to make highly… |
CVE-2020-36718 | Critical | 9.8 | 2023-06-07 | The GDPR CCPA Compliance Support plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.3 via deserialization of untrus… |
CVE-2022-2093 | Medium | 4.8 | 2022-07-11 | The WP Duplicate Page WordPress plugin before 1.3 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to pe… |
CVE-2021-24385 | Critical | 9.8 | 2021-07-12 | The Filebird Plugin 4.7.3 introduced a SQL injection vulnerability as it is making SQL queries without escaping user input data from a HTTP post request. This… |
CVE-2020-24143 | High | 7.5 | 2021-07-07 | Directory traversal in the Video Downloader for TikTok (aka downloader-tiktok) plugin 1.3 for WordPress lets an attacker get access to files that are stored ou… |
CVE-2020-24142 | Critical | 9.8 | 2021-07-07 | Server-side request forgery in the Video Downloader for TikTok (aka downloader-tiktok) plugin 1.3 for WordPress lets an attacker send crafted requests from the… |