Each version is cleaned, compared against the vendor’s license code and scanned before it is committed. A version that does not pass is not published.
Published versions0
Files scanned0
Findings reviewed0
Versions held back23
Held back: archives of this plugin that did not pass the automatic checks and are not published. Findings reviewed: matches of the rules that were checked and resolved before publication.
How every version is checked
Malware scanClamAV
Every file of every version against the ClamAV signature database.
Pattern rulesYARA
Web shells, obfuscated loaders, encoded PHP and known nulling patterns (php-malware-finder plus MeteorGPL rules).
PHP analysisHeuristics
Token-level analysis: remote includes, request input reaching shell functions, decoders feeding eval, PHP hidden in images, fonts or archives, server handler overrides.
License integrityDe-null signatures
License, activation and update code is compared with the vendor’s own code and the previous version; altered license code is never published.
PHP syntaxPHP lint
Every PHP file parses on the PHP version the repository supports.
Asset policy0 images replaced · 0 files removed
Artwork, fonts, media and demo content that may be licensed separately are replaced with placeholders or removed.
Scans per version
Version
Scanned
Files
ClamAV signatures
Findings reviewed
Assets replaced
Duration
Result
Security policy
Reporting a vulnerability. Security problems in the plugin’s own code belong to the vendor, fancyproductdesigner.com; report them there. Problems with a package as this repository distributes it — a file that should not be there, a scan that missed something — go to packages@meteorgpl.com, and are answered within 48 hours.
What happens on a finding. The affected versions are withdrawn from the repository, watchers of the package are notified, and a corrected version is published when one passes every check.
Rights holders. The takedown policy describes how a package is removed.
Known vulnerabilities
Public vulnerability reports for Fancy Product Designer, the versions they affect and the version in this repository that fixes them. Watchers and accounts known to run an affected version are alerted.
The vendor fixed it in 6.5.3; that version is not in the repository yet.
No version in this repository is affected.
Details
The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Order 'elements[].title' Parameter in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is written to the DOM via innerHTML within the beforeElementAdd JavaScript event handler when processing the elements[].title field from the stored order JSON, meaning execution occurs specifically when an administrator reviews shortcode orders in the WordPress admin panel.
Remediation: Update to version 6.5.3, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
The vendor fixed it in 6.5.3; that version is not in the repository yet.
No version in this repository is affected.
Details
The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'productTitle' in '_fpd_data' Order Item Meta in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The fpd_save_order AJAX action is registered for unauthenticated users via wp_ajax_nopriv_fpd_save_order with no nonce or capability check, and the strip_tags() sanitization applied at save time is bypassed by submitting JSON unicode escape sequences (e.g. \u003c, \u003e), which json_decode() silently converts back to literal angle brackets when the order is rendered in the admin view.
Remediation: Update to version 6.5.3, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
The vendor fixed it in 6.5.3; that version is not in the repository yet.
No version in this repository is affected.
Details
The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'output_format' parameter in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the Pro Export/Genius feature to be enabled on the site, as the vulnerable fpd_pr_export AJAX action is only registered when that feature is active.
Remediation: Update to version 6.5.3, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
The vendor fixed it in 6.5.0; that version is not in the repository yet.
No version in this repository is affected.
Details
The Fancy Product Designer plugin for WordPress is vulnerable to Information Disclosure and PHAR Deserialization in all versions up to, and including, 6.4.8. This is due to insufficient validation of user-supplied input in the 'url' parameter of the 'fpd_custom_uplod_file' AJAX action, which flows directly into the 'getimagesize' function without sanitization. This makes it possible for unauthenticated attackers to read arbitrary sensitive files from the server, including wp-config.php.
Remediation: Update to version 6.5.0, or a newer patched version
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
The vendor fixed it in 6.5.0; that version is not in the repository yet.
No version in this repository is affected.
Details
The Fancy Product Designer plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 6.4.8. This is due to improper error handling in the PDF upload functionality that exposes server filesystem paths and stack traces in error messages. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Remediation: Update to version 6.5.0, or a newer patched version
CWE-209: Generation of Error Message Containing Sensitive Information
The vendor fixed it in 6.5.0; that version is not in the repository yet.
No version in this repository is affected.
Details
The Fancy Product Designer plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.4.8. This is due to a time-of-check/time-of-use (TOCTOU) race condition in the 'url' parameter of the fpd_custom_uplod_file AJAX action. The plugin validates the URL by calling getimagesize() first, then later retrieves the same URL using file_get_contents(). This makes it possible for unauthenticated attackers to exploit the timing gap to perform SSRF attacks by serving a valid image during validation, then changing the response to redirect to arbitrary internal or external URLs during the actual fetch.
Remediation: Update to version 6.5.0, or a newer patched version
CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization
The vendor fixed it in 6.5.0; that version is not in the repository yet.
No version in this repository is affected.
Details
The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 6.4.8 due to insufficient input sanitization and output escaping in the data-to-image.php and pdf-to-image.php files. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Remediation: Update to version 6.5.0, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
The vendor fixed it in 6.4.4; that version is not in the repository yet.
No version in this repository is affected.
Details
The Fancy Product Designer plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 6.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Remediation: Update to version 6.4.4, or a newer patched version
CWE-89: Improper Neutralization of Special Elements used in an SQL Command
The vendor fixed it in 6.4.4; that version is not in the repository yet.
No version in this repository is affected.
Details
The Fancy Product Designer plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 6.4.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Remediation: Update to version 6.4.4, or a newer patched version
CWE-434: Unrestricted Upload of File with Dangerous Type
The vendor fixed it in 6.1.8; that version is not in the repository yet.
No version in this repository is affected.
Details
The Fancy Product Designer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 6.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Remediation: Update to version 6.1.8, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
The vendor fixed it in 6.1.81; that version is not in the repository yet.
No version in this repository is affected.
Details
The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to 6.1.81 (exclusive) due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Remediation: Update to version 6.1.81, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
The vendor fixed it in 6.1.81; that version is not in the repository yet.
No version in this repository is affected.
Details
The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to 6.1.81 (exclusive) due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Remediation: Update to version 6.1.81, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
The vendor fixed it in 6.1.5; that version is not in the repository yet.
No version in this repository is affected.
Details
The Fancy Product Designer plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 6.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Remediation: Update to version 6.1.5, or a newer patched version
CWE-89: Improper Neutralization of Special Elements used in an SQL Command
The vendor fixed it in 4.7.0; that version is not in the repository yet.
No version in this repository is affected.
Details
The Fancy Product Designer plugin for WordPress is vulnerable to unauthorized access to data and modification of plugin settings due to a missing capability check on multiple AJAX functions in versions up to, and including, 4.6.9. This makes it possible for authenticated attackers with subscriber-level permissions to modify plugin settings, including retrieving arbitrary order information or creating/updating/deleting products, orders, or other sensitive information not associated with their own account.
Remediation: Update to version 4.7.0, or a newer patched version
The vendor fixed it in 4.7.0; that version is not in the repository yet.
No version in this repository is affected.
Details
The Fancy Product Designer plugin for WordPress is vulnerable to unauthorized modification of site options due to a missing capability check on the fpd_update_options function in versions up to, and including, 4.6.9. This makes it possible for authenticated attackers with subscriber-level permissions to modify site options, including setting the default role to administrator which can allow privilege escalation.
Remediation: Update to version 4.7.0, or a newer patched version
The vendor fixed it in 4.7.6; that version is not in the repository yet.
No version in this repository is affected.
Details
The Fancy Product Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery via the FPD_Admin_Import class that makes it possible for attackers to upload malicious files that could be used to gain webshell access to a server in versions up to, and including, 4.7.5.
Remediation: Update to version 4.7.6, or a newer patched version
The vendor fixed it in 4.7.5; that version is not in the repository yet.
No version in this repository is affected.
Details
The Fancy Product Designer WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the ID parameter found in the ~/inc/api/class-view.php file which allows attackers with administrative level permissions to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 4.7.4.
Remediation: Update to version 4.7.5, or a newer patched version
CWE-89: Improper Neutralization of Special Elements used in an SQL Command
The vendor fixed it in 4.6.9; that version is not in the repository yet.
No version in this repository is affected.
Details
The Fancy Product Designer WordPress plugin before 4.6.9 allows unauthenticated attackers to upload arbitrary files, resulting in remote code execution.
Remediation: Update to version 4.6.9, or a newer patched version
CWE-434: Unrestricted Upload of File with Dangerous Type
The vendor fixed it in 4.5.1; that version is not in the repository yet.
No version in this repository is affected.
Details
The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in versions up to, and including, 4.5.0 due to insufficient file sanitization. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Remediation: Update to version 4.5.1, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Copyright 2012-2026 Defiant Inc.. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/
Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. https://www.cve.org/Legal/TermsOfUse
