CVE-2025-12570 is a stored cross-site scripting vulnerability in the Fancy Product Designer plugin for WordPress, affecting all versions up to 6.4.8. The issue is due to improper neutralization of input during web page generation, specifically in the data-to-image.php and pdf-to-image.php files, which handle SVG file uploads. Attackers can upload crafted SVG files containing malicious scripts that execute in the context of users viewing these files, potentially leading to information disclosure or session hijacking. The vulnerability requires no privileges or user interaction and has a CVSS 3.1 base score of 7.2.

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of users accessing the malicious SVG files. This can lead to information disclosure and integrity impacts, such as theft of user credentials or session tokens. There is no direct impact on availability. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — no official fix or patch links are provided. Users should monitor the vendor's advisory channels for updates and apply any official patches once available. Until a patch is released, consider restricting SVG file uploads or implementing additional input validation and output escaping controls at the application or web server level to mitigate risk.