The Fancy Product Designer plugin for WordPress permits unauthenticated attackers to upload an SVG file containing malicious JavaScript because data-to-image.php and pdf-to-image.php lack proper sanitization and output escaping. This creates a stored cross‑site scripting vulnerability that can inject arbitrary code into any page serving the SVG, potentially compromising the confidentiality and integrity of all site users. The weakness is classified as a classic input validation flaw (CWE‑79).

The vulnerability affects the Fancy Product Designer WordPress plugin version 6.4.8 and all earlier releases, distributed by the vendor radykal. Site administrators running the plugin on WordPress sites must apply an update to eliminate this risk.

The CVSS score of 7.2 indicates moderate‑to‑high severity, while the EPSS score of less than 1% suggests a very low probability of exploitation today. The vulnerability is not listed in CISA’s KEV catalog. Likely attack paths involve any publicly accessible URL that accepts SVG uploads; an attacker can embed JavaScript that executes in the context of any user who accesses the image, thus gaining the same privileges as that user.