Stored Cross-Site Scripting Vulnerability in Fancy Product Designer for WordPress

CVE-2025-12570

What is CVE-2025-12570?

The Fancy Product Designer plugin for WordPress is subject to a Stored Cross-Site Scripting vulnerability when handling SVG file uploads. This issue arises from inadequate input sanitization and output escaping in crucial files, namely data-to-image.php and pdf-to-image.php. The flaw allows unauthenticated attackers to inject arbitrary scripts into web pages, potentially executing malicious code every time users access the compromised SVG files. Users of the affected versions should consider immediate updates and implementing security measures to mitigate potential exploitation.

References