cve,link,title,description,vendor,products,score,severity,epss,cisa,cisa_published,article,ransomware,exploited,poc,trended,trended_no_1,published,trended_score
CVE-2024-0904,https://securityvulnerability.io/vulnerability/CVE-2024-0904,Unfiltered HTML Setting Vulnerability in Fancy Product Designer WordPress Plugin,"The Fancy Product Designer WordPress plugin before 6.1.81 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)",Wordpress,Fancy Product Designer,,,0.0004299999854993075,false,,false,false,true,true,false,false,2024-05-06T06:00:01.281Z,0
CVE-2024-0902,https://securityvulnerability.io/vulnerability/CVE-2024-0902,Unfiltered HTML Setting Vulnerability in Fancy Product Designer WordPress Plugin,"The Fancy Product Designer WordPress plugin before 6.1.81 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)",Wordpress,Fancy Product Designer,,,0.0004299999854993075,false,,false,false,true,true,false,false,2024-04-15T05:00:02.270Z,0
CVE-2024-0365,https://securityvulnerability.io/vulnerability/CVE-2024-0365,SQL Injection Vulnerability in Fancy Product Designer WordPress Plugin,"The Fancy Product Designer WordPress plugin before 6.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by adminstrators.",Wordpress,Fancy Product Designer,,,0.0004299999854993075,false,,false,false,true,true,false,false,2024-03-18T19:05:42.966Z,0
CVE-2021-4334,https://securityvulnerability.io/vulnerability/CVE-2021-4334,Unauthorized Modification Vulnerability in Fancy Product Designer Plugin for WordPress,"The Fancy Product Designer plugin for WordPress is susceptible to unauthorized modifications of site options due to a lack of a capability check in the fpd_update_options function. Authenticated attackers with subscriber-level permissions can exploit this vulnerability to alter critical site configurations, including promoting their role to that of an administrator. This escalation can jeopardize the integrity of the WordPress site, making it essential for users to update to the latest version.",Wordpress,Fancy Product Designer,8.8,HIGH,0.0008099999977275729,false,,false,false,false,,false,false,2023-10-20T07:29:38.814Z,0
CVE-2021-4335,https://securityvulnerability.io/vulnerability/CVE-2021-4335,Unauthorized Access Vulnerability in Fancy Product Designer Plugin for WordPress,"The Fancy Product Designer plugin for WordPress contains a vulnerability that allows authenticated attackers with subscriber-level permissions to perform unauthorized actions. Due to inadequate capability checks on several AJAX functions, these attackers can modify plugin settings and access sensitive information. This includes the ability to retrieve arbitrary order details and create, update, or delete products and orders that do not belong to them. Versions up to and including 4.6.9 are affected, raising significant security concerns for site administrators relying on this plugin.",Wordpress,Fancy Product Designer,6.3,MEDIUM,0.0006200000061653554,false,,false,false,false,,false,false,2023-10-20T06:35:28.661Z,0
CVE-2021-4096,https://securityvulnerability.io/vulnerability/CVE-2021-4096,Fancy Product Designer <= 4.7.5 - Cross-Site Request Forgery to Arbitrary File Upload,"The Fancy Product Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery via the FPD_Admin_Import class that makes it possible for attackers to upload malicious files that could be used to gain webshell access to a server in versions up to, and including, 4.7.5.",Wordpress,Fancy Product Designer,8.8,HIGH,0.0009800000116229057,false,,false,false,false,,false,false,2022-04-19T20:26:38.000Z,0
CVE-2021-4134,https://securityvulnerability.io/vulnerability/CVE-2021-4134,Fancy Product Designer <= 4.7.4 Admin+ SQL Injection,"The Fancy Product Designer WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the ID parameter found in the ~/inc/api/class-view.php file which allows attackers with administrative level permissions to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 4.7.4.",Wordpress,Fancy Product Designer,7.2,HIGH,0.0010499999625608325,false,,false,false,false,,false,false,2022-02-16T16:38:05.000Z,0
CVE-2021-24370,https://securityvulnerability.io/vulnerability/CVE-2021-24370,Fancy Product Designer < 4.6.9 - Unauthenticated Arbitrary File Upload and RCE,"The Fancy Product Designer WordPress plugin before 4.6.9 allows unauthenticated attackers to upload arbitrary files, resulting in remote code execution.",Wordpress,Fancy Product Designer,9.8,CRITICAL,0.29743000864982605,false,,false,false,false,,false,false,2021-06-21T00:00:00.000Z,0