Ninjateam vulnerabilities

Products

• Filebird 8
• Filebird – Wordpress Media Library Folders & File Manager 8
• Filester 7
• File Manager Pro – Filester 6
• Wp Chat App 6
• Wp Chat App 4
• Fastdup – Fastest Wordpress Migration & Duplicator 3
• Wp Duplicate Page 3
• Click To Chat 2
• Fastdup 2
• Filemanager Pro-filester 2
• Gdpr Ccpa Compliance & Cookie Consent Banner 2
• Gdpr Ccpa Compliance \& Cookie Consent Banner 2
• Header Footer Custom Code 2
• Notibar – Notification Bar For Wordpress 2
• Video Downloader For Tiktok 2
• Wp Telegram Chat Widget 2

Newest

• ninjateam filebird – wordpress media library folders & file manager FileBird – WordPress Media Library Folders & File Manager <= 6.5.6 - Authenticated (Author+) Stored Cross-Site Scripting CVE-2026-15004 5.4 MediumSeptember 18, 2026
• ninjateam fastdup – fastest wordpress migration & duplicator FastDup – Fastest WordPress Migration & Duplicator <= 2.7.1 - Missing Authorization to Authenticated (Contributor+) Backup Creation and Download CVE-2026-1104 8.8 HighFebruary 12, 2026
• ninjateam wp duplicate page WP Duplicate Page <= 1.8 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication CVE-2025-14001 Public exploit 5.4 MediumJanuary 13, 2026
• ninjateam fastdup – fastest wordpress migration & duplicator FastDup <= 2.7 - Authenticated (Contributor+) Path Traversal via 'dir_path' REST Parameter CVE-2026-0604 6.5 MediumJanuary 6, 2026
• ninjateam filebird pro WordPress FileBird Pro plugin <= 6.5.1 - Broken Access Control vulnerability CVE-2025-66134 5.4 MediumDecember 16, 2025
• ninjateam filebird – wordpress media library folders & file manager FileBird – WordPress Media Library Folders & File Manager <= 6.5.1 - Missing Authorization to Authenticated (Author+) Global Folders Tampering CVE-2025-12900 4.3 MediumDecember 15, 2025
• ninjateam wp duplicate page WP Duplicate Page <= 1.7 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure CVE-2025-12481 4.3 MediumNovember 18, 2025
• ninjateam filebird – wordpress media library folders & file manager FileBird <= 6.4.9 - Improper Authorization to Authenticated (Author+) Settings Reset CVE-2025-11510 4.3 MediumOctober 18, 2025
• file manager pro, ninja team file manager pro, ninjateam file manager pro – filester +1 more +3 more Multiple elFinder Plugins <= (Various Versions) - Directory Traversal to Arbitrary File Deletion CVE-2025-0818 6.5 MediumAugust 13, 2025
• ninjateam filebird – wordpress media library folders & file manager FileBird – WordPress Media Library Folders & File Manager <= 6.4.8 - Authenticated (Author+) SQL Injection CVE-2025-6986 6.5 MediumAugust 6, 2025
• ninjateam file manager pro – filester File Manager Pro – Filester <= 1.8.8 - Authenticated (Administrator+) Arbitrary File Upload CVE-2025-3234 7.2 HighJune 14, 2025
• ninjateam chat for telegram, wp telegram chat widget +1 more NinjaTeam Chat for Telegram <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via username Parameter CVE-2025-5236 6.4 MediumMay 30, 2025
• ninjateam notibar – notification bar for wordpress Notibar <= 2.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2025-1672 5.5 MediumMarch 6, 2025
• ninja team filebird WordPress FileBird plugin <= 6.4.2.1 - Insecure Direct Object References (IDOR) vulnerability CVE-2025-26977 3.8 LowFebruary 25, 2025
• ninja team gdpr ccpa compliance support, ninjateam gdpr ccpa compliance \& cookie consent banner +1 more WordPress GDPR CCPA Compliance & Cookie Consent Banner plugin <= 2.7.1 - Broken Access Control vulnerability CVE-2025-24591 4.3 MediumJanuary 24, 2025
• ninjateam wp telegram chat widget NinjaTeam Chat for Telegram <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-11885 6.4 MediumDecember 24, 2024
• ninjateam file manager pro – filester, filester +1 more File Manager Pro – Filester <= 1.8.6 - Missing Authorization to Authenticated (Subscriber+) Filebird Plugin Installation CVE-2024-12331 4.3 MediumDecember 19, 2024
• ninjateam notibar – notification bar for wordpress Notibar – Notification Bar for WordPress <= 2.1.4 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via njt_nofi_text CVE-2024-11012 6.3 MediumDecember 13, 2024
• ninja team filebird WordPress FileBird plugin <= 5.1.4 - Broken Access Control vulnerability CVE-2023-25966 5.5 MediumDecember 9, 2024
• ninja team filebird WordPress FileBird Lite plugin <= 6.3.2 - Broken Access Control vulnerability CVE-2024-53825 4.7 MediumDecember 6, 2024
• ninjateam file manager pro – filester, filester, filemanager pro-filester +2 more File Manager Pro – Filester <= 1.8.5 - Authenticated (Administrator+) Local JavaScript File Inclusion CVE-2024-9669 7.2 HighNovember 28, 2024
• ninjateam file manager pro – filester, filester, filemanager pro-filester +2 more File Manager Pro – Filester <= 1.8.6- Authenticated (Subscriber+) Arbitrary File Upload CVE-2024-8066 7.5 HighNovember 28, 2024
• ninjateam wp chat app WP Chat App <= 3.6.8 - Missing Authorization to Authenticated (Subscriber+) Filebird Plugin Installation CVE-2024-10533 4.3 MediumNovember 16, 2024
• ninjateam click to chat, wp click to chat – email, live chat, call & book now buttons +1 more Click to Chat – WP Support All-in-One Floating Widget <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpsaio_snapchat Shortcode CVE-2024-10055 6.4 MediumOctober 18, 2024
• ninja team click to chat – wp support all-in-one floating widget, ninjateam click to chat +1 more WordPress Click to Chat – WP Support All-in-One Floating Widget plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability CVE-2024-49281 6.5 MediumOctober 17, 2024
• ninja team multi step for contact form, ninjateam multi step for contact form 7 +1 more WordPress Multi Step for Contact Form plugin <= 2.7.7 - Unauthenticated SQL Injection vulnerability CVE-2024-47331 9.3 CriticalOctober 11, 2024
• ninjateam header footer custom code, unknown ninjateam header footer custom code +1 more NinjaTeam Header Footer Custom Code <= 1.2 - Admin+ Stored XSS via CSS Styles CVE-2024-6617 4.8 MediumSeptember 13, 2024
• ninjateam header footer custom code, unknown ninjateam header footer custom code +1 more NinjaTeam Header Footer Custom Code < 1.2 - Admin+ Stored XSS CVE-2024-6493 4.8 MediumSeptember 13, 2024
• ninjateam file manager pro – filester, filester +1 more File Manager Pro – Filester <= 1.8.2 - Authenticated Plugin Settings Update CVE-2024-7031 7.5 HighAugust 3, 2024
• ninja team filebird document library WordPress FileBird Document Library plugin <= 2.0.6 - Sensitive Data Exposure vulnerability CVE-2024-37504 5.3 MediumJuly 10, 2024
• ninjateam wp chat app WP Chat App < 3.6.5 - Admin+ Stored XSS CVE-2024-4664 4.8 MediumJune 27, 2024
• ninjateam gdpr ccpa compliance & cookie consent banner, gdpr ccpa compliance \& cookie consent banner +1 more GDPR CCPA Compliance & Cookie Consent Banner <= 2.7.0 - Missing Authorization to Settings Update and Stored Cross-Site Scripting CVE-2024-5607 5.4 MediumJune 7, 2024
• ninja team filebird, firebirdsql firebird +1 more WordPress FileBird – WordPress Media Library Folders & File Manager plugin <= 5.6.3 - Sensitive Data Exposure vulnerability CVE-2024-35166 5.3 MediumMay 13, 2024
• ninjateam filebird, filebird – wordpress media library folders & file manager +1 more FileBird – WordPress Media Library Folders & File Manager <= 5.6.3 - Authenticated (Author+) Insecure Direct Object Reference CVE-2024-2346 5.4 MediumMay 2, 2024
• ninjateam filebird, filebird – wordpress media library folders & file manager +1 more FileBird – WordPress Media Library Folders & File Manager <= 5.6.3 - Authenticated (Author+) Stored Cross-Site Scripting CVE-2024-2345 6.4 MediumMay 2, 2024
• ninjateam wp chat app WP Chat App < 3.6.4 - Admin+ Stored XSS CVE-2024-2837 5.4 MediumApril 26, 2024
• ninjateam wp chat app WP Chat App <= 3.6.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Block Image Attribute CVE-2024-2513 6.4 MediumApril 9, 2024
• ninjateam database for contact form 7 WordPress Database for Contact Form 7 plugin <= 3.0.6 - Unauthenticated Cross Site Scripting (XSS) vulnerability CVE-2024-29103 7.1 HighMarch 19, 2024
• ninjateam wp chat app WP Chat App <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes CVE-2024-1761 6.4 MediumMarch 7, 2024
• ninjateam wp chat app WordPress WP Chat App Plugin <= 3.4.4 is vulnerable to Cross Site Scripting (XSS) CVE-2023-51370 5.9 MediumFebruary 12, 2024
• ninjateam filebird, filebird – wordpress media library folders & file manager +1 more FileBird <= 5.6.0 - Authenticated(Administrator+) Stored Cross-Site Scripting via Folder Import CVE-2024-0691 5.5 MediumFebruary 5, 2024
• ninjateam fastdup FastDup – Fastest WordPress Migration & Duplicator < 2.2 - Directory Listing to Account Takeover and Sensitive Data Exposure CVE-2023-6592 5.3 MediumJanuary 16, 2024
• ninja team fastdup – fastest wordpress migration & duplicator, ninjateam fastdup +1 more WordPress FastDup Plugin <= 2.1.7 is vulnerable to Sensitive Data Exposure CVE-2023-51406 5.3 MediumJanuary 8, 2024
• ninjateam live chat with facebook messenger Live Chat with Facebook Messenger <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2023-5740 6.4 MediumOctober 24, 2023
• ninja team file manager pro, ninjateam filester +1 more File Manager Pro < 1.8.1 - Admin+ Remote Code Execution CVE-2023-4861 Public exploit 7.2 HighOctober 16, 2023
• ninja team file manager pro, ninjateam filester +1 more File Manager Pro < 1.8.1 - Admin+ Stored Cross-Site Scripting CVE-2023-4862 4.8 MediumOctober 16, 2023
• ninja team file manager pro, ninjateam filester +1 more File Manager Pro < 1.8 - Remote Code Execution via CSRF CVE-2023-4827 8.8 HighOctober 16, 2023
• ninjateam gdpr ccpa compliance & cookie consent banner, gpdr ccpa compliance support +1 more GDPR CCPA Compliance Support <= 2.3 - PHP Object Injection CVE-2020-36718 9.8 CriticalJune 7, 2023
• ninjateam wp duplicate page WP Duplicate Page < 1.3 - Admin+ Stored Cross Site Scripting CVE-2022-2093 4.8 MediumJuly 11, 2022
• ninjateam filebird, ninja team filebird – wordpress media library folders & file manager +1 more Filebird 4.7.3 - Unauthenticated SQL Injection CVE-2021-24385 9.8 CriticalJuly 12, 2021
• Show olderLoading…