CVE-2026-84279

Name of the Vulnerable Software and Affected Versions Fancy Product Designer versions prior to 6.5.3

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. This occurs via the output format parameter within the fpd pr export AJAX action. The issue is only exploitable if the Pro Export/Genius feature is enabled on the site.

Recommendations Update to a version newer than 6.5.2. As a temporary mitigation, disable the Pro Export/Genius feature to prevent the registration of the vulnerable fpd pr export AJAX action.