CVE-2026-84280

Name of the Vulnerable Software and Affected Versions Fancy Product Designer versions prior to 6.5.3

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. This occurs when the elements[].title parameter in a shortcode order is processed. The injected payload is written to the Document Object Model (DOM) via innerHTML within the beforeElementAdd() JavaScript event handler. Execution happens when an administrator reviews shortcode orders within the WordPress admin panel.

Recommendations Update to version 6.5.3 or later. As a temporary mitigation, restrict access to the shortcode order review section in the WordPress admin panel.