CVE-2021-4096

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The Fancy Product Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery via the FPD_Admin_Import class that makes it possible for attackers to upload malicious files that could be used to gain webshell access to a server in versions up to, and including, 4.7.5.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352 CWE-434

Affected software

Vendor	Product	Versions
fancy-product-designer	Fancy Product Designer	>= 4.7.5, <= 4.7.5

References

https://support.fancyproductdesigner.com/support/discussions/topics/13000031615Release Notes, Vendor Advisory
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-4096Third Party Advisory
https://support.fancyproductdesigner.com/support/discussions/topics/13000031615Release Notes, Vendor Advisory
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-4096Third Party Advisory

Timeline

Published: Apr 19, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-409609.8Galera WebTemplate 1.0 is affected by a directory traversal vulnerability that could reveal information from /etc/passwd and /etc/shadow.CVE-2021-409618.8CMS Made Simple <=2.2.15 is affected by SQL injection in modules/News/function.admin_articlestab.php. The $sortby variable is concatenated w CVE-2021-409646.5A Path Traversal vulnerability exists in TinyFileManager all version up to and including 2.4.6 that allows attackers to upload a file (with CVE-2021-409658.8A Cross-Site Request Forgery (CSRF) vulnerability exists in TinyFileManager all version up to and including 2.4.6 that allows attackers to u CVE-2021-409665.4A Stored XSS exists in TinyFileManager All version up to and including 2.4.6 in /tinyfilemanager.php when the server is given a file that co CVE-2021-409686.1Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject CVE-2021-409696.1Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject CVE-2021-40975.4phpservermon is vulnerable to Improper Neutralization of CRLF Sequences CVE-2021-409706.1Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject CVE-2021-409716.1Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject CVE-2021-409726.1Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject CVE-2021-409736.1Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject