# cve.now: Ninjateam

The newest entries naming Ninjateam as an affected vendor (up to 200), of 31 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-15004](https://cve.now/CVE-2026-15004.md): FileBird – WordPress Media Library Folders & File Manager \<= 6.5.6 - Authenticated (Author+) Stored Cross-Site Scripting (CVSS 5.4)
- [CVE-2026-1104](https://cve.now/CVE-2026-1104.md): FastDup – Fastest WordPress Migration & Duplicator \<= 2.7.1 - Missing Authorization to Authenticated (Contributor+) Backup Creation and Download (CVSS 8.8)
- [CVE-2025-14001](https://cve.now/CVE-2025-14001.md): WP Duplicate Page \<= 1.8 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication (CVSS 5.4)
- [CVE-2026-0604](https://cve.now/CVE-2026-0604.md): FastDup \<= 2.7 - Authenticated (Contributor+) Path Traversal via 'dir\_path' REST Parameter (CVSS 6.5)
- [CVE-2025-66134](https://cve.now/CVE-2025-66134.md): WordPress FileBird Pro plugin \<= 6.5.1 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2025-12900](https://cve.now/CVE-2025-12900.md): FileBird – WordPress Media Library Folders & File Manager \<= 6.5.1 - Missing Authorization to Authenticated (Author+) Global Folders Tampering (CVSS 4.3)
- [CVE-2025-12481](https://cve.now/CVE-2025-12481.md): WP Duplicate Page \<= 1.7 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure (CVSS 4.3)
- [CVE-2025-11510](https://cve.now/CVE-2025-11510.md): FileBird \<= 6.4.9 - Improper Authorization to Authenticated (Author+) Settings Reset (CVSS 4.3)
- [CVE-2025-0818](https://cve.now/CVE-2025-0818.md): Multiple elFinder Plugins \<= (Various Versions) - Directory Traversal to Arbitrary File Deletion (CVSS 6.5)
- [CVE-2025-6986](https://cve.now/CVE-2025-6986.md): FileBird – WordPress Media Library Folders & File Manager \<= 6.4.8 - Authenticated (Author+) SQL Injection (CVSS 6.5)
- [CVE-2025-3234](https://cve.now/CVE-2025-3234.md): File Manager Pro – Filester \<= 1.8.8 - Authenticated (Administrator+) Arbitrary File Upload (CVSS 7.2)
- [CVE-2025-5236](https://cve.now/CVE-2025-5236.md): NinjaTeam Chat for Telegram \<= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via username Parameter (CVSS 6.4)
- [CVE-2025-1672](https://cve.now/CVE-2025-1672.md): Notibar \<= 2.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 5.5)
- [CVE-2024-11885](https://cve.now/CVE-2024-11885.md): NinjaTeam Chat for Telegram \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-12331](https://cve.now/CVE-2024-12331.md): File Manager Pro – Filester \<= 1.8.6 - Missing Authorization to Authenticated (Subscriber+) Filebird Plugin Installation (CVSS 4.3)
- [CVE-2024-11012](https://cve.now/CVE-2024-11012.md): Notibar – Notification Bar for WordPress \<= 2.1.4 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via njt\_nofi\_text (CVSS 6.3)
- [CVE-2024-9669](https://cve.now/CVE-2024-9669.md): File Manager Pro – Filester \<= 1.8.5 - Authenticated (Administrator+) Local JavaScript File Inclusion (CVSS 7.2)
- [CVE-2024-8066](https://cve.now/CVE-2024-8066.md): File Manager Pro – Filester \<= 1.8.6- Authenticated (Subscriber+) Arbitrary File Upload (CVSS 7.5)
- [CVE-2024-10533](https://cve.now/CVE-2024-10533.md): WP Chat App \<= 3.6.8 - Missing Authorization to Authenticated (Subscriber+) Filebird Plugin Installation (CVSS 4.3)
- [CVE-2024-10055](https://cve.now/CVE-2024-10055.md): Click to Chat – WP Support All-in-One Floating Widget \<= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpsaio\_snapchat Shortcode (CVSS 6.4)
- [CVE-2024-7031](https://cve.now/CVE-2024-7031.md): File Manager Pro – Filester \<= 1.8.2 - Authenticated Plugin Settings Update (CVSS 7.5)
- [CVE-2024-5607](https://cve.now/CVE-2024-5607.md): GDPR CCPA Compliance & Cookie Consent Banner \<= 2.7.0 - Missing Authorization to Settings Update and Stored Cross-Site Scripting (CVSS 5.4)
- [CVE-2024-2346](https://cve.now/CVE-2024-2346.md): FileBird – WordPress Media Library Folders & File Manager \<= 5.6.3 - Authenticated (Author+) Insecure Direct Object Reference (CVSS 5.4)
- [CVE-2024-2345](https://cve.now/CVE-2024-2345.md): FileBird – WordPress Media Library Folders & File Manager \<= 5.6.3 - Authenticated (Author+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-2513](https://cve.now/CVE-2024-2513.md): WP Chat App \<= 3.6.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Block Image Attribute (CVSS 6.4)
- [CVE-2024-29103](https://cve.now/CVE-2024-29103.md): WordPress Database for Contact Form 7 plugin \<= 3.0.6 - Unauthenticated Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2024-1761](https://cve.now/CVE-2024-1761.md): WP Chat App \<= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes (CVSS 6.4)
- [CVE-2023-51370](https://cve.now/CVE-2023-51370.md): WordPress WP Chat App Plugin \<= 3.4.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9)
- [CVE-2024-0691](https://cve.now/CVE-2024-0691.md): FileBird \<= 5.6.0 - Authenticated(Administrator+) Stored Cross-Site Scripting via Folder Import (CVSS 5.5)
- [CVE-2023-5740](https://cve.now/CVE-2023-5740.md): Live Chat with Facebook Messenger \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- [CVE-2020-36718](https://cve.now/CVE-2020-36718.md): GDPR CCPA Compliance Support \<= 2.3 - PHP Object Injection (CVSS 9.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/ninjateam
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.