Filtered by vendor Radykal
Subscriptions
Filtered by product Fancy Product Designer
Subscriptions
Total
5 CVE
CVE | Vendors | Products | Updated | CVSS v3.1 |
---|---|---|---|---|
CVE-2021-4335 | 1 Radykal | 1 Fancy Product Designer | 2024-11-21 | 6.3 Medium |
The Fancy Product Designer plugin for WordPress is vulnerable to unauthorized access to data and modification of plugin settings due to a missing capability check on multiple AJAX functions in versions up to, and including, 4.6.9. This makes it possible for authenticated attackers with subscriber-level permissions to modify plugin settings, including retrieving arbitrary order information or creating/updating/deleting products, orders, or other sensitive information not associated with their own account. | ||||
CVE-2021-4334 | 1 Radykal | 1 Fancy Product Designer | 2024-11-21 | 8.8 High |
The Fancy Product Designer plugin for WordPress is vulnerable to unauthorized modification of site options due to a missing capability check on the fpd_update_options function in versions up to, and including, 4.6.9. This makes it possible for authenticated attackers with subscriber-level permissions to modify site options, including setting the default role to administrator which can allow privilege escalation. | ||||
CVE-2021-4134 | 1 Radykal | 1 Fancy Product Designer | 2024-11-21 | 7.2 High |
The Fancy Product Designer WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the ID parameter found in the ~/inc/api/class-view.php file which allows attackers with administrative level permissions to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 4.7.4. | ||||
CVE-2021-4096 | 1 Radykal | 1 Fancy Product Designer | 2024-11-21 | 8.8 High |
The Fancy Product Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery via the FPD_Admin_Import class that makes it possible for attackers to upload malicious files that could be used to gain webshell access to a server in versions up to, and including, 4.7.5. | ||||
CVE-2021-24370 | 1 Radykal | 1 Fancy Product Designer | 2024-11-21 | 9.8 Critical |
The Fancy Product Designer WordPress plugin before 4.6.9 allows unauthenticated attackers to upload arbitrary files, resulting in remote code execution. |
Page 1 of 1.