Skip to content
OpenAdvisories

Vendor

Ninja Team

49 known vulnerabilities.

Products

FileBird – WordPress Media Library Folders & File Manager 8 File Manager Pro – Filester 6 Filebird 4 WP Chat App 4 FastDup – Fastest WordPress Migration & Duplicator 3 GDPR CCPA Compliance Support 3 WP Telegram Chat Widget 2 Click to Chat – WP Support All-in-One Floating Widget 2 GDPR CCPA Compliance & Cookie Consent Banner 2 WP Duplicate Page 2 Notibar – Notification Bar for WordPress 2 Multi Step for Contact Form 7 1 Database for Contact Form 7 1 FastDup 1 Ninja Beaver Add-ons for Beaver Builder 1 Notibar 1 WP Click to Chat – Email, Live Chat, Call & Book Now Buttons 1 FileBird Document Library 1 File Manager Pro 1 Live Chat with Facebook Messenger 1 FileBird Pro 1 Multi Step for Contact Form 1
All Critical High Medium Low Exploited only Public exploit

49 results · Feed

  • Medium 6.4
    CVE-2024-2513

    WP Chat App <= 3.6.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Block Image Attribute

    The WP Chat App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'imageAlt' block attribute in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes…

    Ninja Team WP Chat App Web / CMS
  • High 7.1
    CVE-2024-29103

    WordPress Database for Contact Form 7 plugin <= 3.0.6 - Unauthenticated Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NinjaTeam Database for Contact Form 7 allows Stored XSS.This issue affects Database for Contact Form 7: from n/a through 3.0.6.

    Ninja Team Database for Contact Form 7
  • Medium 6.4
    CVE-2024-1761

    WP Chat App <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes

    The WP Chat App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget/block in all versions up to, and including, 3.6.1 due to insufficient input sanitization and output escaping on user supplied attributes such as 'buttonC…

    Ninja Team WP Chat App Web / CMS
  • Medium 5.9
    CVE-2023-51370

    WordPress WP Chat App Plugin <= 3.4.4 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NinjaTeam WP Chat App allows Stored XSS.This issue affects WP Chat App: from n/a through 3.4.4.

    Ninja Team WP Chat App
  • Medium 5.5
    CVE-2024-0691

    FileBird <= 5.6.0 - Authenticated(Administrator+) Stored Cross-Site Scripting via Folder Import

    The FileBird plugin for WordPress is vulnerable to Stored Cross-Site Scripting via imported folder titles in all versions up to, and including, 5.5.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attack…

    Ninja Team FileBird – WordPress Media Library Folders & File Manager Web / CMS
  • Medium 5.3
    CVE-2023-51406

    WordPress FastDup Plugin <= 2.1.7 is vulnerable to Sensitive Data Exposure

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ninja Team FastDup – Fastest WordPress Migration & Duplicator.This issue affects FastDup – Fastest WordPress Migration & Duplicator: from n/a through 2.1.7.

    Ninja Team FastDup – Fastest WordPress Migration & Duplicator Web / CMS
  • Medium 6.4
    CVE-2023-5740

    Live Chat with Facebook Messenger <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Live Chat with Facebook Messenger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'messenger' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplie…

    Ninja Team Live Chat with Facebook Messenger Web / CMS
  • Critical 9.8
    CVE-2020-36718

    GDPR CCPA Compliance Support <= 2.3 - PHP Object Injection

    The GDPR CCPA Compliance Support plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.3 via deserialization of untrusted input "njt_gdpr_allow_permissions" value. This allows unauthenticated attackers to inject a PHP …

    Ninja Team GDPR CCPA Compliance & Cookie Consent Banner Web / CMS
  • Unscored —
    CVE-2021-24385

    Filebird 4.7.3 - Unauthenticated SQL Injection

    The Filebird Plugin 4.7.3 introduced a SQL injection vulnerability as it is making SQL queries without escaping user input data from a HTTP post request. This is a major vulnerability as the user input is not escaped and passed directly to the get_col functio…

    Ninja Team FileBird – WordPress Media Library Folders & File Manager Web / CMS