EUVD-2026-86538
GHSA-83rc-2w53-9qfv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Unauthenticated network-reachable stored XSS (PR:N/UI:N) with cross-context scope change (S:C) and low C/I; the Pro-feature gating limits exposure but does not add attacker-side complexity, so AC:L retained.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
3DescriptionCVE.org
The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'output_format' parameter in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the Pro Export/Genius feature to be enabled on the site, as the vulnerable fpd_pr_export AJAX action is only registered when that feature is active.
Articles & Coverage 1
AnalysisAI
Stored cross-site scripting in the Fancy Product Designer WordPress plugin, versions up to and including 6.5.2, lets unauthenticated attackers inject arbitrary web scripts through the output_format parameter when the Pro Export/Genius feature is enabled. The injected payload is stored and executes when any user, including an administrator, later views the affected page; the CVSS 3.1 base score is 7.2, and no public exploit was identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the Pro Export/Genius feature to be enabled in Fancy Product Designer (versions up to and including 6.5.2), since the vulnerable fpd_pr_export AJAX action is only registered when that feature is active - sites without this paid feature enabled are not exposed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) presents this as a network, unauthenticated stored XSS with scope change and low confidentiality/integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis in the provided data; check the vendor site and Wordfence advisory for an updated release addressing versions up to 6.5.2. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within the first 24 hours, inventory all WordPress installations running Fancy Product Designer at version 6.5.2 or earlier, determine which of them have the non-default Pro Export/Genius feature enabled, and for any that do, immediately disable that feature - doing so unregisters the vulnerable fpd_pr_export AJAX action and removes the exposure path - or take the affected site offline if the module is business-critical; simultaneously scan post, option, and product tables for injected script and clear any stored payloads, and review administrator accounts for signs of unauthorized access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today