What’s Vulnerable › Products
radykal Fancy Product Designer vulnerabilities
18 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.
Check whether your radykal Fancy Product Designer version is affected
Latest radykal Fancy Product Designer vulnerabilities
- CVE-2026-84280 — Fancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via Shortcode Order 'elements[].title' Parameter (CVSS 7.2)
- CVE-2026-84281 — Fancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via 'productTitle' in '_fpd_data' Order Item Meta (CVSS 7.2)
- CVE-2026-84279 — Fancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via 'output_format' Parameter via Pro Export Print Job (CVSS 7.2)
- CVE-2025-15526 — Fancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Full Path Disclosure via 'pdf' Parameter (CVSS 5.3)
- CVE-2025-13231 — Fancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Server-Side Request Forgery via Race Condition (CVSS 6.5)
- CVE-2025-13439 — Fancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Information Disclosure and PHAR Deserialization via 'url' Parameter (CVSS 5.9)
- CVE-2025-12570 — Fancy Product Designer <= 6.4.8 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload (CVSS 7.2)
- CVE-2024-51919 — WordPress Fancy Product Designer plugin <= 6.4.3 - Unauthenticated Arbitrary File Upload vulnerability (CVSS 9.0)
- CVE-2024-51818 — WordPress Fancy Product Designer plugin <= 6.4.3 - Unauthenticated SQL Injection vulnerability (CVSS 9.3)
- CVE-2024-0904 — Fancy Product Designer < 6.1.81 - Admin+ Cross Site Scripting (CVSS 5.9)
- CVE-2024-0905 — Fancy Product Designer < 6.1.8 - Reflected Cross Site Scripting (CVSS 6.3)
- CVE-2024-0902 — Fancy Product Designer < 6.1.81 - Admin+ Cross Site Scripting via Product Title (CVSS 4.8)
- CVE-2024-0365 — Fancy Product Designer < 6.1.5 - Admin+ SQL Injection (CVSS 6.5)
- CVE-2021-4334 — Fancy Product Designer <= 4.6.9 - Insufficient Authorization to Arbitrary Options Update via fpd_update_options (CVSS 8.8)
- CVE-2021-4335 — Fancy Product Designer <= 4.6.9 - Insufficient Authorization on Mulitple AJAX Actions (CVSS 6.3)
- CVE-2021-4096 — Fancy Product Designer <= 4.7.5 - Cross-Site Request Forgery to Arbitrary File Upload (CVSS 8.8)
- CVE-2021-4134 — Fancy Product Designer <= 4.7.4 Admin+ SQL Injection (CVSS 4.9)
- CVE-2021-24370 — Fancy Product Designer < 4.6.9 - Unauthenticated Arbitrary File Upload and RCE (CVSS 9.8)