Fancy Product Designer

Fancy Product Designer has 19 disclosed vulnerabilities in the WordSec catalog, reported between 2020 and 2026; all 19 are fixed as of October 2026. Their average CVSS score is 7.1, and the most serious one scores 9.8 out of 10. Severity breakdown: 3 critical and 8 high. 2025 was the busiest year with 6 disclosures.

The most common weakness is Cross-Site Scripting, behind 8 of the records (42%). Other recurring categories include SQL Injection, Improper Authorization.

Every one of the 19 issues recorded for Fancy Product Designer has a vendor fix available, so running the current release closes all known holes.

8 independent researchers contributed these findings, most of them (4) reported by Muhammad Zeeshan (Xib3rR4dAr).

Strategic Overview

Avg CVSSHigh

7.1/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Fancy Product Designer vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2024-51919

Fancy Product Designer <= 6.4.3 - Unauthenticated Arbitrary File Upload

Read the full analysis

Vulnerability Records

19 records


2026-09-24 18:48	Fancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via Shortcode Order 'elements[].title' Parameter Fancy Product Designer <= 6.5.2	`CVE-2026-84280`	7.2 High	h0xilo	Yes
2026-09-24 18:17	Fancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via 'productTitle' in '_fpd_data' Order Item Meta Fancy Product Designer <= 6.5.2	`CVE-2026-84281`	7.2 High	h0xilo	Yes
2026-09-24 00:00	Fancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via 'output_format' Parameter via Pro Export Print Job Fancy Product Designer <= 6.5.2	`CVE-2026-84279`	7.2 High	h0xilo	Yes
2025-12-15 00:00	Fancy Product Designer \| WooCommerce WordPress <= 6.4.8 - Unauthenticated Information Disclosure and PHAR Deserialization via 'url' Parameter Fancy Product Designer <= 6.4.8	`CVE-2025-13439`	5.9 Medium	Muhammad Zeeshan (Xib3rR4dAr)	Yes
2025-12-15 00:00	Fancy Product Designer \| WooCommerce WordPress <= 6.4.8 - Unauthenticated Server-Side Request Forgery via Race Condition Fancy Product Designer <= 6.4.8	`CVE-2025-13231`	6.5 Medium	Muhammad Zeeshan (Xib3rR4dAr)	Yes
2025-12-15 00:00	Fancy Product Designer \| WooCommerce WordPress <= 6.4.8 - Unauthenticated Full Path Disclosure via 'pdf' Parameter Fancy Product Designer <= 6.4.8	`CVE-2025-15526`	5.3 Medium	Muhammad Zeeshan (Xib3rR4dAr)	Yes
2025-12-11 18:11	Fancy Product Designer <= 6.4.8 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload Fancy Product Designer <= 6.4.8	`CVE-2025-12570`	7.2 High	Muhammad Zeeshan (Xib3rR4dAr)	Yes
2025-01-03 00:00	Fancy Product Designer <= 6.4.3 - Unauthenticated Arbitrary File Upload Fancy Product Designer <= 6.4.3	`CVE-2024-51919`	9.8 Critical	Rafie Muhammad	Yes
2025-01-03 00:00	Fancy Product Designer <= 6.4.3 - Unauthenticated SQL Injection Fancy Product Designer <= 6.4.3	`CVE-2024-51818`	7.5 High	Rafie Muhammad	Yes
2024-04-26 00:00	Fancy Product Designer <= 6.1.7 - Reflected Cross-Site Scripting Fancy Product Designer <= 6.1.7	`CVE-2024-0905`	6.1 Medium	Bob Matyas	Yes

Showing 1–10 of 19 reports