WordPress security by component

Fancy Product Designer

Plugin description

Fancy Product Designer allows customers to customize products with text, images, colors, and design elements before placing orders.

Fancy Product Designer (fancy-product-designer) is a WordPress plugin with 18 published CVE records in this archive. The latest tracked vulnerability was published Sep 25, 2026; the highest published CVSS base score is 9.8.

Plugin slug: fancy-product-designer

Latest vulnerability

CVE-2026-84280: Fancy Product Designer: Cross-site scripting

Fancy Product Designer (affected: <= 6.5.2). An unauthenticated attacker can store script markup in elements[].title in shortcode-order JSON. When an administrator reviews the order, the beforeElementAdd JavaScript handler places the value into innerHTML, executing script in the admin browser. The order-submission route is unspecified.

PublishedSep 25, 2026

Safe version guidanceSee mitigation notes

Published vulnerabilities for fancy-product-designer
		Safe version
Sep 25, 2026	CVE-2026-84280 Fancy Product Designer: Cross-site scripting Fancy Product Designer (affected: <= 6.5.2). An unauthenticated attacker can store script markup in elements[].title in shortcode-order JSON. When an administrator reviews the order, the beforeElementAdd JavaScript handler places the value into innerHTML, executing script in the admin browser. The order-submission route is unspecified.	See mitigation notes	CVE7.2 NVDPending
Sep 25, 2026	CVE-2026-84281 Fancy Product Designer: Cross-site scripting Fancy Product Designer (affected: <= 6.5.2). An unauthenticated attacker can submit productTitle inside _fpd_data order-item JSON through fpd_save_order, which lacks nonce and capability checks. JSON Unicode escapes survive strip_tags() at save time and become markup after json_decode(), executing script when an administrator views the order.	See mitigation notes	CVE7.2 NVDPending
Sep 25, 2026	CVE-2026-84279 Fancy Product Designer: Cross-site scripting Fancy Product Designer (affected: <= 6.5.2). An unauthenticated attacker can submit script through output_format to fpd_pr_export. This action exists only while the Pro Export/Genius feature is active; insufficient sanitization and escaping allow stored script execution on a later view. The storage location and precise rendering sink are unspecified.	See mitigation notes	CVE7.2 NVDPending
Jan 16, 2026	CVE-2025-15526 Fancy Product Designer: A security weakness Fancy Product Designer is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3 NVDPending
Dec 16, 2025	CVE-2025-13231 Fancy Product Designer: Server-side request forgery Fancy Product Designer is affected by server-side request forgery. The vulnerable path is reachable without authentication. The vulnerable server can be induced to make attacker-selected network requests.	See mitigation notes	CVE6.5 NVDPending
Dec 16, 2025	CVE-2025-13439 Fancy Product Designer: Code execution Fancy Product Designer is affected by code execution. The vulnerable path is reachable without authentication. Successful exploitation can run attacker-controlled code in the WordPress hosting account.	See mitigation notes	CVE5.9 NVDPending
Dec 12, 2025	CVE-2025-12570 Fancy Product Designer: Cross-site scripting Fancy Product Designer is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE7.2 NVDPending
Jan 21, 2025	CVE-2024-51919 Fancy Product Designer: Dangerous file upload Fancy Product Designer is affected by dangerous file upload. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.	See mitigation notes	CVE9.0 NVDPending
Jan 21, 2025	CVE-2024-51818 Fancy Product Designer: SQL injection Fancy Product Designer is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE9.3 NVDPending
May 06, 2024	CVE-2024-0904 Fancy Product Designer: Cross-site scripting Fancy Product Designer is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.9 NVDPending
Apr 26, 2024	CVE-2024-0905 Fancy Product Designer: Cross-site scripting Fancy Product Designer is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.3 NVDPending
Apr 15, 2024	CVE-2024-0902 Fancy Product Designer: Cross-site scripting Fancy Product Designer is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE4.3 NVD4.8
Mar 18, 2024	CVE-2024-0365 Fancy Product Designer: SQL injection Fancy Product Designer is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE6.5 NVDPending
Oct 20, 2023	CVE-2021-4334 Fancy Product Designer: Privilege escalation or authentication bypass Fancy Product Designer is affected by privilege escalation or authentication bypass. Exploitation requires an authenticated subscriber account. A successful request can grant permissions or access that the caller should not possess.	See mitigation notes	CVE8.8 NVD8.8
Oct 20, 2023	CVE-2021-4335 Fancy Product Designer: A security weakness Fancy Product Designer is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE6.3 NVD6.3
Apr 19, 2022	CVE-2021-4096 Fancy Product Designer: Cross-site request forgery Fancy Product Designer is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE8.8 NVD8.8
Feb 16, 2022	CVE-2021-4134 Fancy Product Designer: SQL injection Fancy Product Designer is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE7.2 NVD4.9
Jun 21, 2021	CVE-2021-24370 Fancy Product Designer: Code execution Fancy Product Designer is affected by code execution. The vulnerable path is reachable without authentication. Successful exploitation can run attacker-controlled code in the WordPress hosting account.	See mitigation notes	CVEPending NVD9.8

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers