CVE-2026-84280 is a stored Cross-Site Scripting vulnerability in the Fancy Product Designer plugin for WordPress, affecting all versions up to and including 6.5.2. The vulnerability is due to improper neutralization of input in the elements[].title parameter of shortcode orders. An attacker can inject arbitrary scripts that are stored and later executed in the admin panel when reviewing orders. The injected payload is inserted into the DOM via innerHTML in the beforeElementAdd event handler, leading to script execution without requiring user interaction.

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of the WordPress admin panel when an administrator views the injected order. This can lead to information disclosure and potential further compromise of the admin session or site integrity. The CVSS 3.1 score is 7.2 (High), reflecting network attack vector, low complexity, no privileges required, no user interaction, and impact on confidentiality and integrity.

No official patch or fix is currently documented. Users should monitor the vendor's advisory channels for updates. Until a fix is available, restrict access to the WordPress admin panel to trusted users only and consider disabling or limiting the use of the Fancy Product Designer plugin's shortcode order functionality. Avoid reviewing untrusted or suspicious orders to reduce risk.