Description

The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'productTitle' in '_fpd_data' Order Item Meta in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The fpd_save_order AJAX action is registered for unauthenticated users via wp_ajax_nopriv_fpd_save_order with no nonce or capability check, and the strip_tags() sanitization applied at save time is bypassed by submitting JSON unicode escape sequences (e.g. \u003c, \u003e), which json_decode() silently converts back to literal angle brackets when the order is rendered in the admin view.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-25T07:16:55.013Z",
  "pubdate": "2026-09-25T07:16:55.013Z",
  "executiveSummary": "The Fancy Product Designer plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability affecting versions up to and including 6.5.2.\nThe vulnerability originates from the insecure handling of the 'productTitle' parameter within the '_fpd_data' Order Item Meta, which lacks robust input sanitization and output escaping.\nAn unauthenticated attacker can exploit this flaw by submitting malicious JavaScript payloads via the 'fpd_save_order' AJAX action.\nBecause the 'fpd_save_order' action is registered with 'wp_ajax_nopriv_fpd_save_order' and lacks both nonce verification and capability checks, the attack surface is exposed to any remote user.\nSuccessful exploitation allows for the execution of arbitrary web scripts within the administrative context whenever an authorized user views the injected order data.\nThis creates significant security implications, including potential account takeover, session hijacking, or the unauthorized modification of administrative actions, as the script executes within the privileged scope of a WordPress administrator.",
  "technicalDetails": "The vulnerability resides in the 'fpd_save_order' AJAX endpoint, which fails to enforce authorization checks or nonces, permitting unauthenticated interaction from any remote source.\nThe root cause is a deficiency in the input sanitization process; while the application utilizes the 'strip_tags()' function to filter incoming data, it performs this sanitization prior to the resolution of JSON unicode escape sequences.\nAttackers can circumvent the 'strip_tags()' filter by obfuscating malicious payloads using unicode escape sequences such as '\\u003c' for '<' and '\\u003e' for '>'.\nWhen the 'fpd_save_order' function processes the incoming request, the underlying 'json_decode()' mechanism subsequently converts these unicode sequences into literal HTML tag delimiters.\nThis resulting payload is then persisted into the WordPress database as part of the order metadata under the 'productTitle' field without further validation.\nThe exploitation flow proceeds as follows: 1) An unauthenticated attacker crafts a malicious payload containing JavaScript wrapped in encoded HTML tags. 2) The attacker sends an HTTP POST request to the 'fpd_save_order' AJAX handler. 3) The server-side code applies 'strip_tags()' to the encoded input, which fails to detect the tags because they are currently represented as unicode escape sequences. 4) 'json_decode()' interprets the payload, transforming it into executable HTML/JavaScript. 5) The payload is stored in the database. 6) When a WordPress administrator navigates to the order details page in the dashboard, the application renders the stored metadata without adequate output escaping.\nThe execution of the injected script occurs within the victim's browser session, granting the attacker the ability to perform actions on behalf of the authenticated user, access sensitive cookies, or redirect the user to malicious domains.\nThis vulnerability is particularly severe due to the lack of administrative authentication requirements to interact with the vulnerable AJAX hook, making the administrative backend accessible to remote, unauthenticated threats."
}