CVE-2026-84281 Details
Description
The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'productTitle' in '_fpd_data' Order Item Meta in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The fpd_save_order AJAX action is registered for unauthenticated users via wp_ajax_nopriv_fpd_save_order with no nonce or capability check, and the strip_tags() sanitization applied at save time is bypassed by submitting JSON unicode escape sequences (e.g. \u003c, \u003e), which json_decode() silently converts back to literal angle brackets when the order is rendered in the admin view.
A stored cross-site scripting vulnerability has been identified in the Fancy Product Designer plugin for WordPress, affecting all versions through 6.5.2. The issue arises from inadequate input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts into pages. These scripts execute when a user accesses the affected page. The vulnerability exploits the 'productTitle' in the '_fpd_data' Order Item Meta. The fpd_save_order AJAX action, available to unauthenticated users, lacks proper nonce or capability checks. Although a strip_tags() sanitization is applied when saving, it can be bypassed by using JSON unicode escape sequences, which are converted back to angle brackets when the order is viewed in the admin panel.
Users are advised to update the Fancy Product Designer plugin to version 6.5.3 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 25, 2026CISA-ADP
Assessed Sep 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://fancyproductdesigner.com/ | [email protected] | Vendor |
| https://www.wordfence.com/threat-intel/vulnerabilities/id/53a70698-f2ee-4694-b21c-8b8ccb0b2a5c?source=cve | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Fancy Product Designer | <= 6.5.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 25, 2026 | CVE Modified | CISA-ADP |
| Sep 25, 2026 | New CVE Received | [email protected] |