PT-2025-50889

CVE-2025-12570

Published

2025-12-11

Updated

2025-12-17

Description by

CVSS 3.1

7.2

High

MetricsAV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Fancy Product Designer plugin for WordPress versions prior to 6.4.9

Description The software is susceptible to Stored Cross-Site Scripting through SVG File uploads. Insufficient input sanitization and output escaping in the data-to-image.php and pdf-to-image.php files allow unauthenticated attackers to inject arbitrary web scripts. These scripts execute when a user accesses the SVG file.

Recommendations Update The Fancy Product Designer plugin to version 6.4.9 or later.

Exploitability

Fix

Impacts

Researchers

Muhammad Hassan

Muhammad Zeeshan

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers