The vulnerability lies in the Fancy Product Designer WordPress plugin version 6.5.2 and earlier, where the 'output_format' parameter used by the Pro Export / Genius feature is not properly sanitized or escaped. This grants unauthenticated users the ability to inject arbitrary JavaScript into pages that are stored and later displayed to other visitors. The injected script will execute automatically whenever a user loads an affected page, potentially compromising their session data, defacing content, or facilitating further attacks on the site and its users.

All WordPress sites running the Fancy Product Designer plugin version 6.5.2 or older are affected. The vulnerability exists only when the Pro Export/Genius feature is enabled because the susceptible AJAX action, fpd_pr_export, is registered under that condition. The vendor identified is radykal.

The CVSS score of 7.2 indicates a high severity and the lack of an EPSS score means the current exploit probability is unknown but the vulnerability remains publicly documented and can be easily exploited. The absence from the CISA KEV catalog does not diminish the risk; attackers can craft a request to the fpd_pr_export endpoint and deliver malicious payloads without needing authentication. The exploitation requires only remote access to the site’s admin‑ajax.php endpoint and the Pro Export feature; therefore, the attack vector is likely remote unauthenticated. The impact is complete loss of confidentiality and potential defacement for all site visitors.