Ninjateam vulnerabilities, page 3

51 vulnerabilities

Known vulnerabilities in Ninjateam products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 21 products.

8.8CVE-2026-1104ninjateamfastdup – fastest wordpress migration & duplicator+1
EPSS score
0.31%
The FastDup – Fastest WordPress Migration & Duplicator plugin for WordPress is vulnerable to unauthorized backup creation and download due to a missing capability check on REST API endpoints in all versions up to, and including, 2.7.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to create and download full-site backup archives containing the entire WordPress installation, including database exports and configuration files.6.5CVE-2026-0604ninjateamfastdup – fastest wordpress migration & duplicator+1
EPSS score
0.38%
The FastDup – Fastest WordPress Migration & Duplicator plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.7 via the 'dir_path' parameter in the 'njt-fastdup/v1/template/directory-tree' REST API endpoint. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary directories on the server, which can contain sensitive information.5.4CVE-2026-15004ninjateamfilebird – wordpress media library folders & file manager+1
EPSS score
0.24%
The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versions up to, and including, 6.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.7.5CVE-2023-51406ninja teamfastdup – fastest wordpress migration & duplicator+2
EPSS score
0.48%
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ninja Team FastDup – Fastest WordPress Migration & Duplicator.This issue affects FastDup – Fastest WordPress Migration & Duplicator: from n/a through 2.1.7.5.9CVE-2023-51370ninjateamwp_chat_app+1
EPSS score
0.34%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NinjaTeam WP Chat App allows Stored XSS.This issue affects WP Chat App: from n/a through 3.4.4.8.8CVE-2023-4827ninjateamfilester+2
EPSS score
7.86%
The File Manager Pro WordPress plugin before 1.8 does not properly check the CSRF nonce in the `fs_connector` AJAX action. This allows attackers to make highly privileged users perform unwanted file system actions via CSRF attacks by using GET requests, such as uploading a web shell.4.8CVE-2023-4862ninjateamfilester+2
EPSS score
0.47%
The File Manager Pro WordPress plugin before 1.8.1 does not adequately validate and escape some inputs, leading to XSS by high-privilege users.7.2CVE-2023-4861ninjateamfilester+2
EPSS score
1.68%
The File Manager Pro WordPress plugin before 1.8.1 allows admin users to upload arbitrary files, even in environments where such a user should not be able to gain full control of the server, such as a multisite installation. This leads to remote code execution.6.5CVE-2023-25966ninja teamfilebird+2
EPSS score
0.65%
Missing Authorization vulnerability in Ninja Team Filebird allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Filebird: from n/a through 5.1.4.6.4CVE-2023-5740ninjateamlive_chat_with_facebook_messenger+1
EPSS score
0.53%
The Live Chat with Facebook Messenger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'messenger' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.9.8CVE-2023-6592ninjateamfastdup+2
EPSS score
0.91%
The FastDup WordPress plugin before 2.2 does not prevent directory listing in sensitive directories containing export files.