NinjaTeam vulnerabilities
We track 10 vulnerabilities in NinjaTeam products across 9 products. 10 are rated high or critical, and none are known to be exploited. The most recent was published on November 14, 2026.
Latest NinjaTeam vulnerabilities
- 7.2 High severity
Multi Step for Contact Form 7: Improper Neutralization of Input During Web Page Generation
The Multi Step for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'multipart field name (array key)' parameter in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. Thi
- 8.8 High severity
FastDup – Fastest WordPress Migration &…: Missing Authorization
The FastDup – Fastest WordPress Migration & Duplicator plugin for WordPress is vulnerable to unauthorized backup creation and download due to a missing capability check on REST API endpoints in all versions up to, and including, 2.7.1. This makes it possible f
- 7.2 High severity
File Manager Pro – Filester: Unrestricted Upload of File with Dangerous Type
The File Manager Pro – Filester plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.8.8. This makes it possible for authenticated attackers, with Administrator-level access an
- 8.8 High severity
GDPR CCPA Compliance Support: Missing Authorization
Missing Authorization vulnerability in Ninja Team GDPR CCPA Compliance Support ninja-gdpr-compliance allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GDPR CCPA Compliance Support: from n/a through <= 2.7.1.
- 7.2 High severity
File Manager Pro – Filester: Improper Limitation of a Pathname to a Restricted Directory
The File Manager Pro – Filester plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to, and including, 1.8.5 via the 'fm_locale' parameter. This makes it possible for authenticated attackers, with Administrator-level access
- 8.8 High severity
File Manager Pro – Filester: Unrestricted Upload of File with Dangerous Type
The File Manager Pro – Filester plugin for WordPress is vulnerable to arbitrary file uploads due to missing validation in the 'fsConnector' function in all versions up to, and including, 1.8.6. This makes it possible for authenticated attackers, with Subscribe
- 9.8 Critical severity
Multi Step for Contact Form: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ninja Team Multi Step for Contact Form cf7-multi-step allows SQL Injection.This issue affects Multi Step for Contact Form: from n/a through <= 2.7.7.
- 8.8 High severity
File Manager Pro – Filester: Missing Authorization
The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'njt_fs_saveSettingRestrictions' function in all versions up to, and including, 1.8.2. This makes it possible for a
- 7.1 High severity
Database for Contact Form 7: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NinjaTeam Database for Contact Form 7 allows Stored XSS.This issue affects Database for Contact Form 7: from n/a through 3.0.6.
- 7.5 High severity
FastDup – Fastest WordPress Migration &…: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ninja Team FastDup – Fastest WordPress Migration & Duplicator.This issue affects FastDup – Fastest WordPress Migration & Duplicator: from n/a through 2.1.7.