CVE-2026-84279 in Fancy Product Designer Plugin
Summary
by MITRE • 09/25/2026
The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'output_format' parameter in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the Pro Export/Genius feature to be enabled on the site, as the vulnerable fpd_pr_export AJAX action is only registered when that feature is active.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability identified within the Fancy Product Designer plugin for WordPress represents a significant security risk due to its potential for Stored Cross-Site Scripting attacks. This flaw exists in all versions of the plugin up through and including version 6.5.2, stemming from insufficient input sanitization and output escaping mechanisms when handling specific user inputs. The primary vector for this exploitation is the 'output_format' parameter associated with the fpd_pr_export AJAX action endpoint. Because the vulnerability allows an attacker to inject arbitrary web scripts into stored data on the server, these malicious payloads are persistently retained within the application's database or file system rather than being transient in a single request response cycle.
The operational impact of this flaw is severe because it enables unauthenticated attackers to compromise the integrity and confidentiality of user sessions without requiring prior authentication credentials. When an administrator or any other privileged user accesses a page containing the injected script, the malicious code executes within their browser context under the trust relationship established with the WordPress site. This execution environment typically grants the attacker access to sensitive information such as session cookies, personal data, or administrative controls, potentially leading to full website compromise if the affected user holds elevated privileges. The requirement for the Pro Export/Genius feature to be enabled acts as a conditional prerequisite, meaning that only sites with this specific functionality activated are susceptible to exploitation via the fpd_pr_export action.
From a technical classification perspective, this vulnerability aligns closely with CWE-79, which defines Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). Specifically, it falls under the stored variant where malicious scripts are permanently stored on target servers and delivered to users when they request information. In terms of adversary tactics, this behavior corresponds to ATT&CK technique T1059, Command and Scripting Interpreter, particularly in how JavaScript is used as a scripting language within web browsers to execute arbitrary commands or exfiltrate data. The lack of proper sanitization on the output_format parameter indicates a failure to implement robust input validation protocols that are standard for handling dynamic content generation in modern web applications.
Mitigation strategies must prioritize immediate remediation by updating the Fancy Product Designer plugin to version 6.5.3 or later, where these security flaws have been addressed through enhanced sanitization and escaping routines. For organizations unable to update immediately due to compatibility constraints, temporary mitigation involves disabling the Pro Export/Genius feature if it is not strictly necessary for business operations, thereby removing access to the vulnerable fpd_pr_export AJAX action endpoint. Additionally, implementing a Web Application Firewall can provide an additional layer of defense by filtering out malicious payloads targeting known vulnerability patterns associated with this plugin before they reach the application logic. Regular security audits and code reviews focusing on input handling in AJAX endpoints are recommended to prevent similar vulnerabilities from being introduced during future development cycles.