Description

The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'output_format' parameter in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the Pro Export/Genius feature to be enabled on the site, as the vulnerable fpd_pr_export AJAX action is only registered when that feature is active.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-25T07:16:54.890Z",
  "pubdate": "2026-09-25T07:16:54.890Z",
  "executiveSummary": "The Fancy Product Designer WordPress plugin is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability residing within the 'output_format' parameter.\nThe flaw stems from inadequate input sanitization and output escaping mechanisms, allowing unauthenticated threat actors to inject malicious JavaScript payloads.\nThis vulnerability specifically impacts sites where the Pro Export/Genius feature is enabled, as this activates the vulnerable 'fpd_pr_export' AJAX handler.\nSuccessful exploitation facilitates the execution of arbitrary scripts within the context of an unsuspecting user's browser session, potentially leading to unauthorized data exfiltration, session hijacking, or administrative account compromise.\nGiven that the attack vector is available to unauthenticated users, the risk profile is critical for deployments utilizing the affected feature set.\nOrganizations must prioritize the mitigation of this vulnerability to ensure the integrity of user interactions and protect against persistent script injection threats.",
  "technicalDetails": "The vulnerability is identified as a Stored Cross-Site Scripting (XSS) flaw affecting Fancy Product Designer versions 6.5.2 and earlier. The root cause is the lack of server-side sanitization and context-aware output encoding on the 'output_format' parameter processed by the 'fpd_pr_export' AJAX action.\nThe 'fpd_pr_export' function is registered dynamically within the WordPress plugin architecture specifically when the Pro Export/Genius feature is enabled. Because this action is exposed to the public via the WordPress AJAX API, unauthenticated visitors can initiate requests to this endpoint.\nThe attack flow begins when an attacker crafts a malicious request targeting the 'fpd_pr_export' endpoint. By supplying a crafted payload containing executable JavaScript within the 'output_format' parameter, the attacker bypasses the nonexistent input validation routines. The server subsequently stores this malicious string within the application database or cache associated with the export process.\nWhen a legitimate user—such as an administrator or another visitor—navigates to the page or triggers a function where the stored data is retrieved and rendered, the application fails to perform proper output escaping. Consequently, the browser interprets the stored string as active content rather than plain text.\nThe impact of this injection allows for the execution of arbitrary JavaScript within the victim's browser. Common post-exploitation activities include the theft of sensitive session cookies, the manipulation of the Document Object Model (DOM) to present fraudulent content, or the unauthorized submission of requests on behalf of the victim (Cross-Site Request Forgery). In scenarios where an administrator views the injected page, the attacker could effectively gain full control over the WordPress environment by creating new administrative users or injecting further backdoors into the theme files.\nThe vulnerability is particularly dangerous because it does not require prior authentication, making it a viable target for automated exploit campaigns targeting public-facing WordPress instances configured with the specified Pro Export feature."
}