Stored Cross-Site Scripting in Fancy Product Designer Plugin for WordPress

CVE-2026-84280

What is CVE-2026-84280?

The Fancy Product Designer plugin for WordPress has a vulnerability that allows Stored Cross-Site Scripting through the 'elements[].title' parameter in all versions up to 6.5.2. This flaw arises from inadequate input sanitization and output escaping, enabling unauthenticated attackers to inject malicious web scripts into WordPress pages. The potentially harmful JavaScript executes when an administrator views shortcode orders in the admin panel, as the payload is rendered directly to the Document Object Model (DOM) via the innerHTML property. This exposure poses significant security risks for users accessing the compromised pages.

References