WPManageNinja vulnerabilities
We track 19 vulnerabilities in WPManageNinja products across 14 products. 19 are rated high or critical, and none are known to be exploited. The most recent was published on November 3, 2026.
Latest WPManageNinja vulnerabilities
- 8.1 High severity
FluentCart A New Era of eCommerce – Faster…: Improper Limitation of a Pathname to a Restricted Directory
The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFile function in all versions up to, and including, 1.6.2. This makes it po
- 7.5 High severity
FluentCart A New Era of eCommerce – Faster…: Authorization Bypass Through User-Controlled Key
The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.7.0 via the 'order_id + billing_address_id (also shipping_address_id)' parameter
- 7.5 High severity
FluentCart: Insertion of Sensitive Information Into Sent Data
Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja FluentCart fluent-cart allows Retrieve Embedded Sensitive Data.This issue affects FluentCart: from n/a through 1.7.1.
- 7.1 High severity
Best Payments Plugin for WP: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Best Payments Plugin for WP wp-payment-form allows Stored XSS.This issue affects Best Payments Plugin for WP: from n/a through 4.6.27.
- 9.8 Critical severity
Ninja Tables Pro: Embedded Malicious Code
Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (app/Library/updater/NinjaTableDataSync.php) that est
- 9.8 Critical severity
Fluent Forms Pro: Embedded Malicious Code
Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (libs/class-license-sync.php), loaded via a require_on
- 7.2 High severity
Fluent Forms – Customizable Contact Forms…: Improper Neutralization of Input During Web Page Generation
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient inpu
- 7.2 High severity
FluentSMTP – WP SMTP Plugin with Amazon SES…: Improper Neutralization of Input During Web Page Generation
The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Recipient Display Name (to.name) in Email Logs in all versions up to, and including
- 7.2 High severity
Fluent Forms – Customizable Contact Forms…: Improper Neutralization of Input During Web Page Generation
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Name Field Nested `password` Member in all versions up to, and including, 6.2.7 due to insufficient
- 7.1 High severity
Fluent CRM: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Fluent CRM fluent-crm allows Reflected XSS.This issue affects Fluent CRM: from n/a through <= 3.1.7.
- 7.1 High severity
FluentCart: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja FluentCart fluent-cart allows Reflected XSS.This issue affects FluentCart: from n/a through < 1.3.0.
- 7.2 High severity
Ninja Tables – Easy Data Table Builder: Server-Side Request Forgery
The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.18 via the args[url] parameter. This makes it possible for unauthenticated attackers to make web requests to
- 7.5 High severity
Fluent Support – Helpdesk & Customer Support…: Exposure of Sensitive Information to an Unauthorized Actor
The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.5 via the 'fluent-support' directory. This makes it possible for unauthenticated attac
- 9.8 Critical severity
FluentSMTP – WP SMTP Plugin with Amazon SES…: Deserialization of Untrusted Data
The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.82 via deserialization of untrusted input in the 'fo
- 9.8 Critical severity
Fluent Support: Missing Authorization
Missing Authorization vulnerability in Shahjahan Jewel Fluent Support fluent-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Support: from n/a through <= 1.8.0.
- 8.8 High severity
Fluent Forms – Customizable Contact Forms…: Deserialization of Untrusted Data
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.1.15 via deserialization of untrusted input in the extractDynamicValues
- 7.2 High severity
Fluent Support – WordPress Helpdesk and…: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPManageNinja LLC Fluent Support – WordPress Helpdesk and Customer Support Ticket Plugin.This issue affects Fluent Support – WordPress Helpdesk and Customer S
- 7.2 High severity
Fluent Support – WordPress Helpdesk and…: Improper Neutralization of Special Elements used in an SQL Command
The Fluent Support WordPress plugin before 1.5.8 does not properly sanitise, validate and escape various parameters before using them in an SQL statement, leading to an SQL Injection vulnerability exploitable by high privilege users
- 7.5 High severity
Ninja Job Board – Ultimate WordPress Job Board…: Direct Request
The Ninja Job Board WordPress plugin before 1.3.3 does not protect the directory where it stores uploaded resumes, making it vulnerable to unauthenticated Directory Listing which allows the download of uploaded resumes.