CVE-2026-84279 radykal CVE debrief

Who should care

WordPress administrators and defenders who manage sites using the Fancy Product Designer plugin should assess their exposure to this vulnerability and prioritize verification and potential remediation.

Why it matters

CVE-2026-84279 is a Stored Cross-Site Scripting vulnerability in the Fancy Product Designer plugin for WordPress. Defenders should prioritize verifying the presence of this vulnerability, assessing exposure, and remediating if necessary to prevent potential attacks.

• Unauthenticated attackers could inject arbitrary web scripts in pages that execute when accessed by users.
• Successful exploitation could lead to user session hijacking or other malicious actions.
• Defenders must verify the presence of this vulnerability in their WordPress installations.
• Remediation priority is high if the Pro Export/Genius feature is enabled.

Technical summary

The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'output_format' parameter in all versions up to, and including, 6.5.2. The vulnerability requires the Pro Export/Genius feature to be enabled on the site. This allows unauthenticated attackers to inject web scripts that execute when accessed by users, potentially leading to user session hijacking or other malicious actions. Defenders should verify the plugin's presence, assess exposure, and prioritize remediation if the feature is enabled.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and assess the exposure of their sites to unauthenticated Stored Cross-Site Scripting attacks.

Recommended defensive actions

• Verify the presence of the Fancy Product Designer plugin in your WordPress installation and check if the version is up to 6.5.2.
• Assess whether the Pro Export/Genius feature is enabled on your site.
• Consider disabling the Pro Export/Genius feature if not in use.
• Monitor your site for potential Stored Cross-Site Scripting attacks.
• Update the plugin to a version that addresses this vulnerability, if available.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, including its description, CVSS score, and affected versions. However, the corpus does not establish versions, exploitation, impact, or remediation beyond the provided information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.