Vendor
WP ManageNinja
68 known vulnerabilities.
Products
23 results · Clear filters · Feed
-
High 8.1
FluentCart A New Era of eCommerce <= 1.6.2 - Authenticated (Custom+) Arbitrary File Deletion via 'file_path' Parameter
The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFile function in all versions up to, and including, 1.6.2. This makes it p…
-
High 7.5
FluentCart A New Era of eCommerce <= 1.7.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'order_id' and 'billing_address_id' Parameters
The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.7.0 via the 'order_id + billing_address_id (also shipping_address_id)' paramete…
-
High 8.8
WordPress Fluent CRM plugin <= 3.2.5 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5.
-
High 7.5
WordPress FluentCart plugin <= 1.7.1 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja FluentCart fluent-cart allows Retrieve Embedded Sensitive Data.This issue affects FluentCart: from n/a through 1.7.1.
-
High 7.1
WordPress Best Payments Plugin for WP plugin <= 4.6.27 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Best Payments Plugin for WP wp-payment-form allows Stored XSS.This issue affects Best Payments Plugin for WP: from n/a through 4.6.27.
-
High 7.5
WordPress Fluent Affiliate Pro plugin <= 1.6.4 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Fluent Affiliate Pro <= 1.6.4 versions.
-
High 7.5
WordPress FluentBooking Pro plugin < 2.5.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in FluentBooking Pro < 2.5.0 versions.
-
High 7.5
WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Privilege Escalation vulnerability
Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack <= 6.2.12 versions.
-
High 7.5
WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack <= 6.2.12 versions.
-
High 8.1
WordPress FluentBooking Pro plugin <= 2.2.4 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery (CSRF) in FluentBooking Pro <= 2.2.4 versions.
-
High 7.2
WordPress Fluent Boards Pro plugin <= 2.0.11 - PHP Object Injection vulnerability
Editor PHP Object Injection in Fluent Boards Pro <= 2.0.11 versions.
-
High 7.2
WordPress FluentCRM Pro plugin <= 3.1.12 - Privilege Escalation vulnerability
Editor Privilege Escalation in FluentCRM Pro <= 3.1.12 versions.
-
High 7.6
WordPress FluentCRM Pro plugin <= 3.1.12 - SQL Injection vulnerability
Author SQL Injection in FluentCRM Pro <= 3.1.12 versions.
-
High 7.1
WordPress Fluent Forms Pro Add On Pack plugin < 6.2.12 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions.
-
High 7.2
Fluent Forms <= 6.2.11 - Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient inp…
-
High 7.1
WordPress Ninja Tables plugin <= 5.2.9 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Ninja Tables <= 5.2.9 versions.
-
High 7.2
FluentSMTP <= 2.2.95 - Unauthenticated Stored Cross-Site Scripting via Recipient Display Name (to.name) in Email Logs
The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Recipient Display Name (to.name) in Email Logs in all versions up to, and includin…
-
High 7.2
Fluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Name Field Nested `password` Member in all versions up to, and including, 6.2.7 due to insufficien…
-
High 7.1
WordPress Fluent CRM plugin <= 3.1.7 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Fluent CRM fluent-crm allows Reflected XSS.This issue affects Fluent CRM: from n/a through <= 3.1.7.
-
High 7.5
WordPress Best Payments Plugin for WP plugin <= 4.6.19 - Payment Bypass vulnerability
Unauthenticated Bypass Vulnerability in Best Payments Plugin for WP <= 4.6.19 versions.
-
High 7.1
WordPress FluentCart plugin < 1.3.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja FluentCart fluent-cart allows Reflected XSS.This issue affects FluentCart: from n/a through < 1.3.0.
-
High 7.6
WordPress Fluent Support Plugin <= 1.7.6 is vulnerable to SQL Injection
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPManageNinja LLC Fluent Support – WordPress Helpdesk and Customer Support Ticket Plugin.This issue affects Fluent Support – WordPress Helpdesk and Customer …
-
High 8.8
CSRF in WP Fluent Forms < 3.6.67 allows stored XSS and Privilege Escalation
The WP Fluent Forms plugin < 3.6.67 for WordPress is vulnerable to Cross-Site Request Forgery leading to stored Cross-Site Scripting and limited Privilege Escalation due to a missing nonce check in the access control function for administrative AJAX actions