CVE-2026-84281

Name of the Vulnerable Software and Affected Versions Fancy Product Designer versions prior to 6.5.3

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. This occurs when the fpd save order AJAX action, registered via wp ajax nopriv fpd save order, is used without nonce or capability checks. Attackers can bypass the strip tags() sanitization by submitting JSON unicode escape sequences in the productTitle variable within the fpd data Order Item Meta. These sequences are converted back to literal angle brackets by json decode() when the order is rendered in the admin view, leading to the execution of arbitrary web scripts when a user accesses the affected page.

Recommendations Update to a version newer than 6.5.2.