Description

The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Order 'elements[].title' Parameter in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is written to the DOM via innerHTML within the beforeElementAdd JavaScript event handler when processing the elements[].title field from the stored order JSON, meaning execution occurs specifically when an administrator reviews shortcode orders in the WordPress admin panel.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-25T08:16:40.550Z",
  "pubdate": "2026-09-25T08:16:40.550Z",
  "executiveSummary": "The Fancy Product Designer plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 6.5.2.\nThe flaw originates from improper input sanitization and output escaping within the 'elements[].title' parameter of shortcode orders.\nThis vulnerability allows unauthenticated attackers to inject malicious JavaScript payloads into order data.\nThe primary risk involves the execution of arbitrary code within the context of an administrator's browser session when they view the affected shortcode orders in the WordPress administrative interface.\nBecause the payload is rendered via the beforeElementAdd JavaScript event handler, the impact includes unauthorized administrative actions, session hijacking, or the theft of sensitive data managed by the plugin.\nThis represents a high-risk security flaw as it bypasses standard authorization checks to target highly privileged users, necessitating an immediate update or the implementation of restrictive access controls.",
  "technicalDetails": "The vulnerability resides in the way the Fancy Product Designer plugin processes and renders order metadata. Specifically, the 'elements[].title' parameter, which is part of the shortcode order JSON, lacks sufficient input sanitization. This allows an attacker to supply crafted input containing HTML markup and JavaScript vectors.\nThe root cause is a failure to sanitize input during the data submission process combined with a failure to escape output during rendering in the DOM. When the plugin processes the stored order JSON, it utilizes the beforeElementAdd JavaScript event handler to dynamically build elements within the WordPress admin panel.\nThe application insecurely injects the unsanitized 'elements[].title' string directly into the DOM using the 'innerHTML' property. Because 'innerHTML' does not automatically encode or sanitize strings, any embedded scripts are parsed and executed by the browser.\nThe attack flow begins when an unauthenticated attacker submits a request containing the malicious payload within the 'elements[].title' field. This malicious data is saved into the database as part of the order configuration. The vulnerability remains latent until an administrator navigates to the plugin's order management interface to review the shortcode orders.\nOnce the administrator views the malicious entry, the JavaScript event handler 'beforeElementAdd' triggers, causing the payload to execute in the administrator's security context. This allows the attacker to perform actions on behalf of the administrator, such as modifying plugin configurations, injecting further malicious scripts, or exfiltrating data, depending on the payload's intent.\nThis vulnerability is categorized as Stored XSS because the payload is permanently stored on the server and is executed automatically upon a specific administrative action, requiring no further interaction from the attacker after the initial injection."
}