CVE-2026-84281
HighCVSS 7.2Summary
The Fancy Product Designer plugin for WordPress (versions up to and including 6.5.2) is vulnerable to Stored Cross-Site Scripting via 'productTitle' in '_fpd_data' Order Item Meta. The fpd_save_order AJAX action is registered for unauthenticated users without nonce or capability checks, and the strip_tags() sanitization is bypassed using JSON unicode escape sequences that json_decode() converts back to angle brackets when the order is rendered in the admin view.
Risk Assessment
An unauthenticated attacker can inject arbitrary scripts into pages that execute in the browser of any user visiting the injected page, potentially leading to session theft or admin account takeover.
Recommendation
Update the Fancy Product Designer plugin to a version newer than 6.5.2, or if not possible, disable the plugin or restrict access to the fpd_save_order action.
Other vulnerabilities in Fancy Product Designer
See all- CVE-2026-84280High
The Fancy Product Designer plugin for WordPress (versions up to and including 6.5.2) is vulnerable to stored cross-site scripting via the 'elements[].title' parameter in shortcode orders due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts that execute when a user visits an injected page. The injected payload is written to the DOM via innerHTML within the beforeElementAdd JavaScript event handler when processing the elements[].title field from the stored order JSON, meaning execution occurs specifically when an administrator reviews shortcode orders in the WordPress admin panel.
- CVE-2026-84279High
The Fancy Product Designer plugin for WordPress (versions up to and including 6.5.2) is vulnerable to Stored Cross-Site Scripting via the 'output_format' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary scripts into pages that execute when a user visits the injected page. This requires the Pro Export/Genius feature to be enabled, as the vulnerable fpd_pr_export AJAX action is only registered when that feature is active.
Original NVD description (English source)
The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'productTitle' in '_fpd_data' Order Item Meta in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The fpd_save_order AJAX action is registered for unauthenticated users via wp_ajax_nopriv_fpd_save_order with no nonce or capability check, and the strip_tags() sanitization applied at save time is bypassed by submitting JSON unicode escape sequences (e.g. \u003c, \u003e), which json_decode() silently converts back to literal angle brackets when the order is rendered in the admin view.