Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

CVE detail

CVE-2021-24370

The Fancy Product Designer WordPress plugin before 4.6.9 allows unauthenticated attackers to upload arbitrary files, resulting in remote code execution.

CVSS 9.8 · CriticalBuzz score 29.1

Buzz score

Why this CVE is surfacing

Buzz score total 29.1

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 16.1 · diversity 13.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Mention score
16.1
4 evidence mentions in the snapshot
Diversity score
13.0
4 sources across 2 categories
KEV score
0.0
No KEV entry observed
OTX score
0.0
0 OTX pulses
PoC score
0.0
0 repos · best confidence N/A
Best PoC traction
0
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
0
within the 30d window
Peak daily
0
highest bucket

Evidence

Source links by recency

Newest mentions first
4 source links · newest first
  • 7th June – Threat Intelligence ReportCheck Point Research

    For the latest discoveries in cyber research for the week of 7th June, please download our Threat Intelligence Bulletin. Top Attacks and Breaches Check Point Research has identified a new cyber espionage weapon called SharpPanda being used by a Chinese threat group, in an ongoing surveillance operation targeting a Southeast Asian government. The attack starts […]

    vendorresearch.checkpoint.comJun 7, 2021, 3:24 PM
  • Critical 0day in the Fancy Product Designer WordPress plugin actively exploitedSecurity Affairs

    A critical zero-day vulnerability in the Fancy Product Designer WordPress plugin exposes more than 17,000 websites to attacks. Researchers from the Wordfence team at WordPress security company Defiant warn that a critical zero-day vulnerability, tracked as CVE-2021-24370, in the Fancy Product Designer WordPress plugin is actively exploited in the wild. Fancy Product Designer is a […]

    newssecurityaffairs.comJun 2, 2021, 6:20 PM
  • Actively Exploited Zero-Day Found in Popular WordPress eCommerce PluginSecurityWeek

    More than 17,000 websites are exposed to attacks targeting a critical zero-day vulnerability in the Fancy Product Designer WordPress plugin, the Wordfence team at WordPress security company Defiant warns.

    newswww.securityweek.comJun 2, 2021, 3:02 PM
  • Critical 0-day in Fancy Product Designer Under Active AttackWordfence

    Update: A patched version of Fancy Product Designer, 4.6.9, is now available as of June 2, 2021. This article has been updated to reflect newly available information, including Indicators of Compromise. On May 31, 2021, the Wordfence Threat Intelligence team discovered a critical file upload vulnerability being actively exploited in Fancy Product Designer, a WordPress … Read More

    vendorwww.wordfence.comJun 1, 2021, 3:59 PM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars
No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence
  • CVE-2021-4096

    The Fancy Product Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery via the FPD_Admin_Import class that makes it possible for attackers to upload malicious…

    CVSS 8.8 · High
  • CVE-2026-63048

    The Joomla extension Page Builder CK is vulnerable to an authenticated arbitrary file upload, leading to RCE.

    CVSS 9.4 · Critical
    1 mention
  • CVE-2026-16451

    A security flaw has been discovered in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. This impacts an unknown function of the file /api/system/file/upload of…

    CVSS 2.1 · Low
    5 mentions
  • CVE-2026-16447

    A vulnerability has been found in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /web/jquery/uploader/multi_uploadify.php. The manipulation of the argument File…

    CVSS 5.5 · Medium
    6 mentions
  • CVE-2026-16332

    A vulnerability was detected in D-Link DNS-320 1.0.2. This impacts an unknown function of the file /mydlink/multi_uploadify.php. Performing a manipulation of the argument Filedata…

    CVSS 5.5 · Medium
    6 mentions
  • CVE-2026-16331

    A security vulnerability has been detected in D-Link DNS-320 1.0.2. This affects an unknown function of the file /web/function/save_ajax.php. Such manipulation of the argument Mal…

    CVSS 5.5 · Medium
    6 mentions