Stored XSS in Fancy Product Designer WordPress Plugin (CVE-2026-84279)

The Fancy Product Designer plugin for WordPress is affected by a stored cross-site scripting (XSS) vulnerability, identified as CVE-2026-84279. The flaw resides in the 'output_format' parameter and affects all versions up to and including 6.5.2. The vulnerability stems from inadequate input sanitization and output escaping within the plugin's code. To exploit this, the 'Pro Export/Genius' feature must be enabled, as the vulnerable 'fpd_pr_export' AJAX action is only registered when this feature is active. An unauthenticated attacker can leverage this flaw to inject arbitrary web scripts into pages. These scripts execute in the context of a victim's browser whenever they access an affected page, potentially leading to unauthorized actions, session hijacking, or credential theft. This vulnerability represents a significant risk to WordPress sites utilizing the affected plugin and feature configuration.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the browsers of users viewing the injected content. This could result in unauthorized administrative actions, the theft of session cookies, redirection to malicious domains, or the exfiltration of sensitive user data. The vulnerability impacts all WordPress sites running the vulnerable plugin versions with the specified feature enabled.

Recommendation

• Immediately update the Fancy Product Designer plugin to the latest version beyond 6.5.2 to remediate CVE-2026-84279.
• Disable the 'Pro Export/Genius' feature if it is not strictly required for site functionality until an update can be applied.
• Monitor web application firewall (WAF) logs for POST requests directed at the 'fpd_pr_export' AJAX action that contain suspicious script tags or JavaScript event handlers in the 'output_format' parameter.