GCVE - cpe:2.3:a:unknown:fancy_product_designer:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:unknown:fancy_product_designer:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Unknown (`668ca391-a6cc-5e33-879b-83885214de33`)
Product	Fancy Product Designer (`51c2e995-9e93-51cc-be3e-58faa4309c0a`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-0905`	vulnerable	2026-06-08 06:22:03.104405	Fancy Product Designer < 6.1.8 - Reflected Cross Site Scripting The Fancy Product Designer WordPress plugin before 6.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against unauthenticated and admin-level users Published: 2024-04-26T05:00:01.958Z Updated: 2024-08-01T18:18:19.000Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/3b9eba0d-29aa-47e4-b17f-4cf4bbf8b690/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-0904`	vulnerable	2026-06-08 06:22:03.102459	Fancy Product Designer < 6.1.81 - Admin+ Cross Site Scripting The Fancy Product Designer WordPress plugin before 6.1.81 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Published: 2024-05-06T06:00:01.281Z Updated: 2025-03-28T15:50:49.914Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/baf4afc9-c20e-47d6-a798-75e15652d1e3/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-0902`	vulnerable	2026-06-08 06:22:03.098648	Fancy Product Designer < 6.1.81 - Admin+ Cross Site Scripting via Product Title The Fancy Product Designer WordPress plugin before 6.1.81 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Published: 2024-04-15T05:00:02.270Z Updated: 2025-03-26T20:27:40.483Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/fd53e40a-516b-47b9-b495-321774432367/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-0365`	vulnerable	2026-06-08 06:22:00.459237	Fancy Product Designer < 6.1.5 - Admin+ SQL Injection The Fancy Product Designer WordPress plugin before 6.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by adminstrators. Published: 2024-03-18T19:05:42.966Z Updated: 2024-08-08T20:38:59.032Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/4b8b9638-d52a-40bc-b298-ae1c74788c18/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-24370`	vulnerable	2026-06-08 05:30:04.260643	Fancy Product Designer < 4.6.9 - Unauthenticated Arbitrary File Upload and RCE The Fancy Product Designer WordPress plugin before 4.6.9 allows unauthenticated attackers to upload arbitrary files, resulting in remote code execution. Published: 2021-06-21T00:00:00.000Z Updated: 2024-08-03T19:28:23.807Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/82c52461-1fdc-41e4-9f51-f9dd84962b38 https://www.wordfence.com/blog/2021/06/critical-0-day-in-fancy-product-designer-under-active-attack/ https://lists.openwall.net/full-disclosure/2020/11/17/2 https://seclists.org/fulldisclosure/2020/Nov/30 https://www.secpod.com/blog/critical-zero-day-flaw-actively-exploited-in-wordpress-fancy-product-designer-plugin/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.