https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-5236.htmlhttps://patchthecve.com/cve/CVE-2025-5236.htmlWed, 17 Jun 2026 09:47:31 +0000MEDIUM 6.4: The NinjaTeam Chat for Telegram plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘username’ parameter in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-lehttps://patchthecve.com/cve/CVE-2025-26977.htmlhttps://patchthecve.com/cve/CVE-2025-26977.htmlWed, 17 Jun 2026 09:02:41 +0000LOW 3.8: Authorization Bypass Through User-Controlled Key vulnerability in Ninja Team Filebird filebird allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Filebird: from n/a through <= 6.4.2.1.https://patchthecve.com/cve/CVE-2025-24591.htmlhttps://patchthecve.com/cve/CVE-2025-24591.htmlWed, 17 Jun 2026 08:59:16 +0000MEDIUM 4.3: Missing Authorization vulnerability in Ninja Team GDPR CCPA Compliance Support ninja-gdpr-compliance allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GDPR CCPA Compliance Support: from n/a through <= 2.7.1.https://patchthecve.com/cve/CVE-2024-12331.htmlhttps://patchthecve.com/cve/CVE-2024-12331.htmlWed, 17 Jun 2026 06:59:30 +0000MEDIUM 4.3: The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_install_plugin' function in all versions up to, and including, 1.8.6. This makes it possible for authenticated attackers, with Subscriber-level acceshttps://patchthecve.com/cve/CVE-2023-25966.htmlhttps://patchthecve.com/cve/CVE-2023-25966.htmlWed, 17 Jun 2026 05:42:22 +0000MEDIUM 5.5: Missing Authorization vulnerability in Ninja Team Filebird allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Filebird: from n/a through 5.1.4.https://patchthecve.com/cve/CVE-2024-53825.htmlhttps://patchthecve.com/cve/CVE-2024-53825.htmlWed, 17 Jun 2026 08:09:22 +0000MEDIUM 4.7: Missing Authorization vulnerability in Ninja Team Filebird filebird allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Filebird: from n/a through <= 6.3.2.https://patchthecve.com/cve/CVE-2024-9669.htmlhttps://patchthecve.com/cve/CVE-2024-9669.htmlWed, 17 Jun 2026 08:25:01 +0000HIGH 7.2: The File Manager Pro – Filester plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to, and including, 1.8.5 via the 'fm_locale' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbithttps://patchthecve.com/cve/CVE-2024-8066.htmlhttps://patchthecve.com/cve/CVE-2024-8066.htmlWed, 17 Jun 2026 08:21:47 +0000HIGH 7.5: The File Manager Pro – Filester plugin for WordPress is vulnerable to arbitrary file uploads due to missing validation in the 'fsConnector' function in all versions up to, and including, 1.8.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted pehttps://patchthecve.com/cve/CVE-2024-10533.htmlhttps://patchthecve.com/cve/CVE-2024-10533.htmlWed, 17 Jun 2026 06:55:52 +0000MEDIUM 4.3: The WP Chat App plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the ajax_install_plugin() function in all versions up to, and including, 3.6.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to ihttps://patchthecve.com/cve/CVE-2024-10055.htmlhttps://patchthecve.com/cve/CVE-2024-10055.htmlWed, 17 Jun 2026 06:54:50 +0000MEDIUM 6.4: The Click to Chat – WP Support All-in-One Floating Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpsaio_snapchat shortcode in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping on user supplied attributes. Thttps://patchthecve.com/cve/CVE-2024-49281.htmlhttps://patchthecve.com/cve/CVE-2024-49281.htmlWed, 17 Jun 2026 07:59:38 +0000MEDIUM 6.5: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Ninja Team Click to Chat – WP Support All-in-One Floating Widget support-chat allows Stored XSS.This issue affects Click to Chat – WP Support All-in-One Floating Widget: from n/a through <= 2.https://patchthecve.com/cve/CVE-2024-47331.htmlhttps://patchthecve.com/cve/CVE-2024-47331.htmlWed, 17 Jun 2026 07:56:53 +0000CRITICAL 9.3: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ninja Team Multi Step for Contact Form cf7-multi-step allows SQL Injection.This issue affects Multi Step for Contact Form: from n/a through <= 2.7.7.https://patchthecve.com/cve/CVE-2024-6617.htmlhttps://patchthecve.com/cve/CVE-2024-6617.htmlWed, 17 Jun 2026 08:18:21 +0000MEDIUM 4.8: The NinjaTeam Header Footer Custom Code WordPress plugin before 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite https://patchthecve.com/cve/CVE-2024-6493.htmlhttps://patchthecve.com/cve/CVE-2024-6493.htmlWed, 17 Jun 2026 08:18:07 +0000MEDIUM 4.8: The NinjaTeam Header Footer Custom Code WordPress plugin before 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite https://patchthecve.com/cve/CVE-2024-4664.htmlhttps://patchthecve.com/cve/CVE-2024-4664.htmlWed, 17 Jun 2026 08:02:21 +0000MEDIUM 4.8: The WP Chat App WordPress plugin before 3.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admins to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.https://patchthecve.com/cve/CVE-2024-5607.htmlhttps://patchthecve.com/cve/CVE-2024-5607.htmlWed, 17 Jun 2026 08:16:17 +0000MEDIUM 5.4: The GDPR CCPA Compliance & Cookie Consent Banner plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions named ajaxUpdateSettings() in all versions up to, and including, 2.7.0. This makes it possible for authenticated attackers, https://patchthecve.com/cve/CVE-2024-35166.htmlhttps://patchthecve.com/cve/CVE-2024-35166.htmlWed, 17 Jun 2026 07:34:28 +0000MEDIUM 5.3: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ninja Team Filebird.This issue affects Filebird: from n/a through 5.6.3.https://patchthecve.com/cve/CVE-2024-2346.htmlhttps://patchthecve.com/cve/CVE-2024-2346.htmlWed, 17 Jun 2026 07:24:21 +0000MEDIUM 5.4: The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.3 via folder deletion due to missing validation on a user controlled key. This makes it possible for authenticated attackers,https://patchthecve.com/cve/CVE-2024-2345.htmlhttps://patchthecve.com/cve/CVE-2024-2345.htmlWed, 17 Jun 2026 07:24:21 +0000MEDIUM 6.4: The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the folder name parameter in all versions up to, and including, 5.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticathttps://patchthecve.com/cve/CVE-2024-2837.htmlhttps://patchthecve.com/cve/CVE-2024-2837.htmlWed, 17 Jun 2026 07:25:39 +0000MEDIUM 5.4: The WP Chat App WordPress plugin before 3.6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admins to perform Cross-Site Scripting attacks even when unfiltered_html is disallowedhttps://patchthecve.com/cve/CVE-2024-2513.htmlhttps://patchthecve.com/cve/CVE-2024-2513.htmlWed, 17 Jun 2026 07:24:41 +0000MEDIUM 6.4: The WP Chat App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'imageAlt' block attribute in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,https://patchthecve.com/cve/CVE-2024-1761.htmlhttps://patchthecve.com/cve/CVE-2024-1761.htmlWed, 17 Jun 2026 07:04:57 +0000MEDIUM 6.4: The WP Chat App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget/block in all versions up to, and including, 3.6.1 due to insufficient input sanitization and output escaping on user supplied attributes such as 'buttonColor' and 'phoneNumber'. This makes it pohttps://patchthecve.com/cve/CVE-2023-51370.htmlhttps://patchthecve.com/cve/CVE-2023-51370.htmlWed, 17 Jun 2026 06:40:49 +0000MEDIUM 5.9: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NinjaTeam WP Chat App allows Stored XSS.This issue affects WP Chat App: from n/a through 3.4.4.https://patchthecve.com/cve/CVE-2023-51406.htmlhttps://patchthecve.com/cve/CVE-2023-51406.htmlWed, 17 Jun 2026 06:40:53 +0000MEDIUM 5.3: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ninja Team FastDup – Fastest WordPress Migration & Duplicator.This issue affects FastDup – Fastest WordPress Migration & Duplicator: from n/a through 2.1.7.