Advisories · Technology

radykal Fancy Product Designer.

Every CVE that names radykal Fancy Product Designer among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-84280 CVE record

CVSS 7.2 High

Fancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via Shortcode Order 'elements[].title' Parameter
- radykal Fancy Product Designer
- Cross-site scripting (XSS)
Not analysed yet 25 Sept 2026
CVE-2026-84279 CVE record

CVSS 7.2 High

Fancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via 'output_format' Parameter via Pro Export Print Job
- radykal Fancy Product Designer
- Cross-site scripting (XSS)
Not analysed yet 25 Sept 2026
CVE-2026-84281 CVE record

CVSS 7.2 High

Fancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via 'productTitle' in '_fpd_data' Order Item Meta
- radykal Fancy Product Designer
- Cross-site scripting (XSS)
Not analysed yet 25 Sept 2026
CVE-2025-15526 CVE record

CVSS 5.3 Medium

Fancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Full Path Disclosure via 'pdf' Parameter
- radykal Fancy Product Designer
- Information disclosure
Not analysed yet 16 Jan 2026
CVE-2025-13231 CVE record

CVSS 6.5 Medium

Fancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Server-Side Request Forgery via Race Condition
- radykal Fancy Product Designer
- Race condition
Not analysed yet 16 Dec 2025
CVE-2025-13439 CVE record

CVSS 5.9 Medium

Fancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Information Disclosure and PHAR Deserialization via 'url' Parameter
- radykal Fancy Product Designer
- Information disclosure
Not analysed yet 16 Dec 2025
CVE-2025-12570 CVE record

CVSS 7.2 High

Fancy Product Designer <= 6.4.8 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload
- radykal Fancy Product Designer
- Cross-site scripting (XSS)
Not analysed yet 12 Dec 2025
CVE-2024-51919 CVE record

CVSS 9.0 CriticalCritical · CVSS 9+

WordPress Fancy Product Designer plugin <= 6.4.3 - Unauthenticated Arbitrary File Upload vulnerability
- radykal Fancy Product Designer
- Unrestricted file upload
Not analysed yet 21 Jan 2025
CVE-2024-51818 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

WordPress Fancy Product Designer plugin <= 6.4.3 - Unauthenticated SQL Injection vulnerability
- radykal Fancy Product Designer
- SQL injection
Not analysed yet 21 Jan 2025
CVE-2021-4334 CVE record

CVSS 8.8 High

Fancy Product Designer <= 4.6.9 - Insufficient Authorization to Arbitrary Options Update via fpd_update_options
- radykal Fancy Product Designer
- Broken access control
Not analysed yet 20 Oct 2023
CVE-2021-4335 CVE record

CVSS 6.3 Medium

Fancy Product Designer <= 4.6.9 - Insufficient Authorization on Mulitple AJAX Actions
- radykal Fancy Product Designer
- Broken access control
Not analysed yet 20 Oct 2023