Risk Profile
6.3
CVSS Score
Vulnerability Report
Plugin
Medium
Patch path listed
CVE-2021-4335
Fancy Product Designer <= 4.6.9 - Insufficient Authorization on Mulitple AJAX Actions
The Fancy Product Designer plugin for WordPress is vulnerable to unauthorized access to data and modification of plugin settings due to a missing capability check on multiple AJAX functions in versions up to, and including, 4.6.9. This makes it possible for authenticated attackers with subscriber-level permissions to modify plugin settings, including retrieving arbitrary order information or creating/updating/deleting products, orders, or other sensitive information not associated with their own account.
Quick Answer
CVE-2021-4335 is a medium severity with CVSS 6.3 Vulnerability issue affecting the Plugin Fancy Product Designer. It affects Versions up to 4.6.9 and is fixed in 4.7.0.
Published
Apr 05, 2023
Last Updated
Jan 22, 2024
Slug
fancy-product-designer
Patch Status
Patched release is available
Remediation
Update to version 4.7.0, or a newer patched version
Operator Briefing
CVE-2021-4335 is tracked for the Plugin Fancy Product Designer as medium severity with CVSS 6.3. The affected range is Versions up to 4.6.9. Update Fancy Product Designer to 4.7.0 or newer where that version is compatible with the site.
Issue Type
Vulnerability
Primary Fixed Version
4.7.0
Primary Affected Range
Versions up to 4.6.9
Tracking ID
CVE-2021-4335
Detailed Metadata
| Software Type | Plugin |
|---|---|
| Software Slug |
fancy-product-designer
View on wordpress.org
|
| CVE | CVE-2021-4335 |
| Patched Versions |
4.7.0
|
| Affected Versions |
Versions up to 4.6.9
|
Related CVE Cluster
Related CVEs for Fancy Product Designer
These internal links group the same WordPress plugin by CVE, issue type, severity, and patch status so operators and search engines can connect the full vulnerability cluster.
Critical
CVE-2024-51919
6.4.4
Jan 03, 2025
CVE-2024-51919 Fancy Product Designer Remote Code Execution
Fancy Product Designer <= 6.4.3 - Unauthenticated Arbitrary File Upload
Critical
CVE-2021-24370
4.6.9
Jun 01, 2021
CVE-2021-24370 Fancy Product Designer Remote Code Execution
Fancy Product Designer <= 4.6.8 - Unauthenticated Arbitrary File Upload
Critical
CVE-2024-0365
6.1.5
Feb 20, 2024
CVE-2024-0365 Fancy Product Designer SQL Injection
Fancy Product Designer <= 6.1.4 - Authenticated (Admin+) SQL Injection
High
CVE-2021-4334
4.7.0
Apr 05, 2023
CVE-2021-4334 Fancy Product Designer Privilege Escalation
Fancy Product Designer <= 4.6.9 - Insufficient Authorization to Arbitrary Options Update via fpd_update_options
High
CVE-2021-4096
4.7.6
Apr 14, 2022
CVE-2021-4096 Fancy Product Designer Arbitrary File Upload
Fancy Product Designer <= 4.7.5 - Cross-Site Request Forgery to Arbitrary File Upload
High
CVE-2024-51818
6.4.4
Jan 03, 2025
CVE-2024-51818 Fancy Product Designer SQL Injection
Fancy Product Designer <= 6.4.3 - Unauthenticated SQL Injection
High
CVE-2025-12570
6.5.0
Dec 11, 2025
CVE-2025-12570 Fancy Product Designer File Upload
Fancy Product Designer <= 6.4.8 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload
High
CVE-2021-4134
4.7.5
Feb 08, 2022
CVE-2021-4134 Fancy Product Designer SQL Injection
Fancy Product Designer <= 4.7.4 - Admin+ SQL Injection
Licensing Notices
This record contains material that is subject to copyright
DEFIANT
Copyright 2012-2026 Defiant Inc.
License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more
MITRE
Copyright 1999-2026 The MITRE Corporation
License: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more