CVE-2021-47965

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

WordPress Plugin WP Super Edit 2.5.4 and earlier contains an unrestricted file upload vulnerability in the FCKeditor component that allows attackers to upload dangerous file types without validation. Attackers can upload arbitrary files through the filemanager upload endpoint to achieve remote code execution and complete system compromise.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
May 15, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2021

CVE-2021-479668.2PHP Timeclock 1.04 contains time-based and boolean-based blind SQL injection vulnerabilities in the login_userid parameter of login.php thatCVE-2021-479676.1PHP Timeclock 1.04 contains multiple cross-site scripting vulnerabilities that allow unauthenticated attackers to inject arbitrary JavaScripCVE-2021-479686.4Podcast Generator 3.1 is vulnerable to persistent cross-site scripting, allowing authenticated attackers to inject malicious scripts by submCVE-2021-479697.5Color Notes 1.4 contains a denial of service vulnerability that allows attackers to crash the application by pasting excessively long characCVE-2021-479707.5Macaron Notes 5.5 contains a denial of service vulnerability that allows attackers to crash the application by creating notes with excessiveCVE-2021-479717.5My Notes Safe 5.3 contains a denial of service vulnerability that allows attackers to crash the application by pasting excessively long charCVE-2021-479727.5Sticky Notes & Color Widgets 1.4.2 contains a denial of service vulnerability that allows attackers to crash the application by creating notCVE-2021-479737.5Sticky Notes Widget 3.0.6 contains a denial of service vulnerability that allows attackers to crash the application by pasting excessively lCVE-2021-479747.8VX Search 13.5.28 contains an unquoted service path vulnerability in both VX Search Server and VX Search Enterprise services that allows locCVE-2021-479757.2WP Learn Manager 1.1.2 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scriptCVE-2021-479768.8TextPattern CMS 4.9.0-dev contains a remote code execution vulnerability that allows authenticated attackers to upload arbitrary PHP files bCVE-2021-479777.5WordPress Plugin Anti-Malware Security and Bruteforce Firewall 4.20.59 contains a directory traversal vulnerability that allows unauthentica
CVE-2021-47965: Critical severity, CVSS 9.8 | Vulnix