The Fancy Product Designer WordPress plugin is vulnerable to Stored Cross‑Site Scripting via the 'elements[].title' parameter in the shortcode order JSON. Insufficient input sanitization and output escaping allow an unauthenticated attacker to inject and persist arbitrary JavaScript. The injected code is written into the DOM through an innerHTML call during the beforeElementAdd event, and will execute whenever an administrator reviews shortcode orders, potentially giving the attacker in‑browser access to privileged actions or data.

WordPress sites that use the Fancy Product Designer plugin, versions up to and including 6.5.2. No specific earlier version range is detailed, so all releases through 6.5.2 are impacted.

The CVSS score of 7.2 describes moderate‑to‑high severity, and the vulnerability is exploitable by unauthenticated users who can submit or modify order data. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. If an attacker can insert a malicious payload into an order title field, the script will run in the context of the WordPress administrator when that order is reviewed. Because the attack does not require advanced techniques and can be performed through normal shop interactions, the risk of exploitation is moderate to high for exposed or publicly accessible sites.