CVE-2026-84279 is a stored cross-site scripting vulnerability in the Fancy Product Designer plugin for WordPress. The flaw exists in the handling of the 'output_format' parameter, which is not properly sanitized or escaped before being output. This allows unauthenticated attackers to inject arbitrary JavaScript that executes when users access the affected pages. The vulnerability is conditional on the Pro Export/Genius feature being enabled, as the vulnerable AJAX action 'fpd_pr_export' is only available in that mode. All plugin versions from 0 up to and including 6.5.2 are affected.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected site, potentially allowing theft of user credentials, session hijacking, or other malicious actions limited to the confidentiality and integrity of user data. The CVSS score of 7.2 (high) reflects the network attack vector, no privileges required, no user interaction needed, and impact on confidentiality and integrity but not availability.

No official patch or fix is currently documented. Users should verify if the vendor has released an update addressing this vulnerability. Until a fix is available, disabling the Pro Export/Genius feature will prevent registration of the vulnerable AJAX action and mitigate the risk. Monitor the vendor advisory for updates and apply patches promptly once released.