EUVD-2026-86536
GHSA-4wqf-6xrq-qp4m
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Unauthenticated remote injection via nopriv AJAX with no nonce gives AV:N/AC:L/PR:N/UI:N; stored XSS firing in the admin context is S:C with C:L/I:L, A:N.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
3DescriptionCVE.org
The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'productTitle' in '_fpd_data' Order Item Meta in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The fpd_save_order AJAX action is registered for unauthenticated users via wp_ajax_nopriv_fpd_save_order with no nonce or capability check, and the strip_tags() sanitization applied at save time is bypassed by submitting JSON unicode escape sequences (e.g. \u003c, \u003e), which json_decode() silently converts back to literal angle brackets when the order is rendered in the admin view.
Articles & Coverage 1
AnalysisAI
Stored cross-site scripting in the Fancy Product Designer WordPress plugin (all versions through 6.5.2) lets unauthenticated attackers inject arbitrary JavaScript into order item metadata, which executes in an administrator's browser when the affected order is opened in wp-admin. The injection route is the plugin's fpd_save_order AJAX action, registered for logged-out users via wp_ajax_nopriv_fpd_save_order with no nonce and no capability check, and the strip_tags() sanitization applied at save time is bypassed by submitting JSON unicode escape sequences that json_decode() converts back into literal angle brackets at render time. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitable remotely and unauthenticated at injection time because the fpd_save_order AJAX action is registered for logged-out users via wp_ajax_nopriv_fpd_save_order with no nonce and no capability check, on any site running Fancy Product Designer <= 6.5.2 in default configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine, higher-priority WordPress plugin flaw rather than an inflated high-CVSS-but-low-real-risk issue, though its ceiling is bounded by being XSS rather than RCE. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The intelligence provided does not identify a vendor-released patch version, so no fixed release number can be cited and affected sites should check the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/53a70698-f2ee-4694-b21c-8b8ccb0b2a5c?source=cve) and the vendor site (https://fancyproductdesigner.com/) for an updated build before assuming one exists. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every WordPress and WooCommerce site running Fancy Product Designer at version 6.5.2 or earlier, confirm whether the fpd_save_order AJAX action is reachable by logged-out users (wp_ajax_nopriv_fpd_save_order), and where the plugin is not business-critical, deactivate it outright; where it must stay live, deploy an edge WAF or reverse-proxy rule that blocks unauthenticated POST requests to admin-ajax.php carrying the fpd_save_order action, and force re-authentication plus credential rotation for all administrator accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today