CVE-2026-84281 is a stored cross-site scripting vulnerability in the Fancy Product Designer WordPress plugin (versions up to and including 6.5.2). The issue stems from inadequate sanitization of the 'productTitle' field in the '_fpd_data' order item meta. The AJAX endpoint 'fpd_save_order' is exposed to unauthenticated users without nonce or capability checks. Attackers can bypass the strip_tags() sanitization by submitting JSON unicode escape sequences that decode into angle brackets, enabling injection of arbitrary scripts that execute when the injected page is accessed, including in the admin view.

An unauthenticated attacker can inject persistent malicious scripts into order metadata, which execute in the context of users viewing the affected pages, including administrators. This can lead to theft of credentials, session hijacking, or other malicious actions. The vulnerability has a CVSS 3.1 score of 7.2 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity with a scope change.

No official patch or fix is currently documented. Users should monitor the vendor's advisory for updates. Until a fix is available, restrict access to the affected AJAX endpoint if possible, and consider disabling the Fancy Product Designer plugin if not essential. Avoid exposing the plugin to untrusted users. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.