Ninjateam vulnerabilities
51 vulnerabilities
Known vulnerabilities in Ninjateam products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 21 products.
Products
21- Filebird8 vulnerabilities
- Filebird – Wordpress Media Library Folders & File Manager7 vulnerabilities
- Filester7 vulnerabilities
- File Manager Pro – Filester6 vulnerabilities
- Wp Chat App6 vulnerabilities
- Gdpr Ccpa Compliance \& Cookie Consent Banner3 vulnerabilities
- Wp Duplicate Page3 vulnerabilities
- Click To Chat2 vulnerabilities
- Fastdup2 vulnerabilities
- Fastdup – Fastest Wordpress Migration & Duplicator2 vulnerabilities
- Header Footer Custom Code2 vulnerabilities
- Notibar – Notification Bar For Wordpress2 vulnerabilities
- Video Downloader For Tiktok2 vulnerabilities
- WP Telegram Chat Widget2 vulnerabilities
- Chat For Telegram1 vulnerabilities
- Database For Contact Form 71 vulnerabilities
- Filebird Pro1 vulnerabilities
- Gpdr Ccpa Compliance Support1 vulnerabilities
- Live Chat With Facebook Messenger1 vulnerabilities
- Multi Step For Contact Form 71 vulnerabilities
- WP Click To Chat – Email, Live Chat, Call & Book Now Buttons1 vulnerabilities
CVE-2021-24385ninja teamfilebird – wordpress media library folders & file manager+2
EPSS score2.85%
The Filebird Plugin 4.7.3 introduced a SQL injection vulnerability as it is making SQL queries without escaping user input data from a HTTP post request. This is a major vulnerability as the user input is not escaped and passed directly to the get_col function and it allows SQL injection. The Rest API endpoint which invokes this function also does not have any required permissions/authentication and can be accessed by an anonymous user.CVE-2025-1672ninjateamnotibar – notification bar for wordpress+1EPSS score0.31%
The Notibar – Notification Bar for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.CVE-2025-11510ninjateamfilebird – wordpress media library folders & file manager+1EPSS score0.26%
The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /filebird/v1/fb-wipe-clear-all-data function in all versions up to, and including, 6.4.9. This makes it possible for authenticated attackers, with author-level access and above, to reset all of the plugin's configuration data.CVE-2025-26977ninja teamfilebird+2EPSS score0.41%
Authorization Bypass Through User-Controlled Key vulnerability in Ninja Team Filebird filebird allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Filebird: from n/a through <= 6.4.2.1.CVE-2025-0818file managerfile manager pro+5EPSS score1.00%
Several WordPress plugins using elFinder versions 2.1.64 and prior are vulnerable to Directory Traversal in various versions. This makes it possible for unauthenticated attackers to delete arbitrary files. Successful exploitation of this vulnerability requires a site owner to explicitly make an instance of the file manager available to users.CVE-2025-14001ninjateamwp_duplicate_page+1EPSS score0.25%
The WP Duplicate Page plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'duplicateBulkHandle' and 'duplicateBulkHandleHPOS' functions in all versions up to, and including, 1.8. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate arbitrary posts, pages, and WooCommerce HPOS orders even when their role is explicitly excluded from the plugin's "Allowed User Roles" setting, potentially exposing sensitive information and allowing duplicate fulfillment of WooCommerce orders.CVE-2025-66134ninjateamfilebird pro+1EPSS score0.25%
Missing Authorization vulnerability in NinjaTeam FileBird Pro filebird-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FileBird Pro: from n/a through <= 6.5.1.CVE-2025-5236ninjateamchat_for_telegram+2EPSS score0.27%
The NinjaTeam Chat for Telegram plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘username’ parameter in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2025-24591ninja teamgdpr ccpa compliance support+2EPSS score0.50%
Missing Authorization vulnerability in Ninja Team GDPR CCPA Compliance Support ninja-gdpr-compliance allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GDPR CCPA Compliance Support: from n/a through <= 2.7.1.CVE-2025-6986ninjateamfilebird – wordpress media library folders & file manager+1EPSS score0.39%
The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to SQL Injection via the 'search' parameter in all versions up to, and including, 6.4.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.CVE-2025-12481ninjateamwp_duplicate_page+1EPSS score0.25%
The WP Duplicate Page plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.7. This is due to the plugin not properly verifying that a user is authorized to perform an action in the 'saveSettings' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to modify plugin settings that control role capabilities, and subsequently exploit the misconfigured capabilities to duplicate and view password-protected posts containing sensitive information.CVE-2025-12900ninjateamfilebird – wordpress media library folders & file manager+1EPSS score0.23%
The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 6.5.1 via the "ConvertController::insertToNewTable" function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author level access and above, to inject global folders and reassign arbitrary media attachments to those folders under certain circumstances.CVE-2025-3234ninjateamfile manager pro – filester+1EPSS score0.62%
The File Manager Pro – Filester plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.8.8. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Administrators have the ability to extend file manager usage privileges to lower-level users including subscribers, which would make this vulnerability more severe on such sites.CVE-2020-36718ninjateamgdpr_ccpa_compliance_\&_cookie_consent_banner+2EPSS score1.72%
The GDPR CCPA Compliance Support plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.3 via deserialization of untrusted input "njt_gdpr_allow_permissions" value. This allows unauthenticated attackers to inject a PHP Object.CVE-2020-24143ninjateamvideo_downloader_for_tiktok+1EPSS score1.97%
Directory traversal in the Video Downloader for TikTok (aka downloader-tiktok) plugin 1.3 for WordPress lets an attacker get access to files that are stored outside the web root folder via the njt-tk-download-video parameter.CVE-2020-24142ninjateamvideo_downloader_for_tiktok+1EPSS score1.68%
Server-side request forgery in the Video Downloader for TikTok (aka downloader-tiktok) plugin 1.3 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerable web application via the njt-tk-download-video parameter. It can help identify open ports, local network hosts and execute command on servicesCVE-2022-2093ninjateamwp_duplicate_page+2EPSS score0.59%
The WP Duplicate Page WordPress plugin before 1.3 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.CVE-2024-2345ninjateamfilebird+2EPSS score0.34%
The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the folder name parameter in all versions up to, and including, 5.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2024-2513ninjateamwp_chat_app+1EPSS score0.36%
The WP Chat App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'imageAlt' block attribute in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2024-2837ninjateamwp_chat_app+2EPSS score0.52%
The WP Chat App WordPress plugin before 3.6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admins to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed