Ninjateam vulnerabilities
31 CVEs and advisories name Ninjateam as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-15004FileBird – WordPress Media Library Folders & File Manager <= 6.5.6 - Authenticated (Author+) Stored Cross-Site Scripting
- CVE-2026-1104FastDup – Fastest WordPress Migration & Duplicator <= 2.7.1 - Missing Authorization to Authenticated (Contributor+) Backup Creation and Download
- CVE-2025-14001WP Duplicate Page <= 1.8 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication
- CVE-2026-0604FastDup <= 2.7 - Authenticated (Contributor+) Path Traversal via 'dir_path' REST Parameter
- CVE-2025-66134WordPress FileBird Pro plugin <= 6.5.1 - Broken Access Control vulnerability
- CVE-2025-12900FileBird – WordPress Media Library Folders & File Manager <= 6.5.1 - Missing Authorization to Authenticated (Author+) Global Folders Tampering
- CVE-2025-12481WP Duplicate Page <= 1.7 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure
- CVE-2025-11510FileBird <= 6.4.9 - Improper Authorization to Authenticated (Author+) Settings Reset
- CVE-2025-0818Multiple elFinder Plugins <= (Various Versions) - Directory Traversal to Arbitrary File Deletion
- CVE-2025-6986FileBird – WordPress Media Library Folders & File Manager <= 6.4.8 - Authenticated (Author+) SQL Injection
- CVE-2025-3234File Manager Pro – Filester <= 1.8.8 - Authenticated (Administrator+) Arbitrary File Upload
- CVE-2025-5236NinjaTeam Chat for Telegram <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via username Parameter
- CVE-2025-1672Notibar <= 2.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
- CVE-2024-11885NinjaTeam Chat for Telegram <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12331File Manager Pro – Filester <= 1.8.6 - Missing Authorization to Authenticated (Subscriber+) Filebird Plugin Installation
- CVE-2024-11012Notibar – Notification Bar for WordPress <= 2.1.4 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via njt_nofi_text
- CVE-2024-9669File Manager Pro – Filester <= 1.8.5 - Authenticated (Administrator+) Local JavaScript File Inclusion
- CVE-2024-8066File Manager Pro – Filester <= 1.8.6- Authenticated (Subscriber+) Arbitrary File Upload
- CVE-2024-10533WP Chat App <= 3.6.8 - Missing Authorization to Authenticated (Subscriber+) Filebird Plugin Installation
- CVE-2024-10055Click to Chat – WP Support All-in-One Floating Widget <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpsaio_snapchat Shortcode
- CVE-2024-7031File Manager Pro – Filester <= 1.8.2 - Authenticated Plugin Settings Update
- CVE-2024-5607GDPR CCPA Compliance & Cookie Consent Banner <= 2.7.0 - Missing Authorization to Settings Update and Stored Cross-Site Scripting
- CVE-2024-2346FileBird – WordPress Media Library Folders & File Manager <= 5.6.3 - Authenticated (Author+) Insecure Direct Object Reference
- CVE-2024-2345FileBird – WordPress Media Library Folders & File Manager <= 5.6.3 - Authenticated (Author+) Stored Cross-Site Scripting
- CVE-2024-2513WP Chat App <= 3.6.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Block Image Attribute
- CVE-2024-29103WordPress Database for Contact Form 7 plugin <= 3.0.6 - Unauthenticated Cross Site Scripting (XSS) vulnerability
- CVE-2024-1761WP Chat App <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes
- CVE-2023-51370WordPress WP Chat App Plugin <= 3.4.4 is vulnerable to Cross Site Scripting (XSS)
- CVE-2024-0691FileBird <= 5.6.0 - Authenticated(Administrator+) Stored Cross-Site Scripting via Folder Import
- CVE-2023-5740Live Chat with Facebook Messenger <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode