Disclosures

漏洞披露 本仓库包含我的漏洞报告，这些报告不受保密协议（NDA）约束，也不受 VRP 服务条款的限制。 目录 Fancy Product Designer Microsoft Xfinity...

CVE-2026-75098

The Product Designer App plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.3 via the 'svg' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive...

EUVD-2026-89684

The Product Designer App plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.3 via the 'svg' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive...

CVE-2026-75098 Product Designer App <= 1.1.3 - Unauthenticated Arbitrary File Read via 'svg' Parameter in pdapp-render-design

The Product Designer App plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.3 via the 'svg' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive...

CVE-2026-75098 Product Designer App <= 1.1.3 - Unauthenticated Arbitrary File Read via 'svg' Parameter in pdapp-render-design

The Product Designer App plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.3 via the 'svg' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive...

CVE-2026-75098

The Product Designer App plugin for WordPress (versions up to and including 1.1.3 ) is vulnerable to an unauthenticated arbitrary file read via a Directory Traversal flaw in the svg parameter. An attacker can exploit this by obtaining a nonce and token, which are publicly emitted as JavaScript gl...

WordPress Product Designer App plugin <= 1.1.3 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by Sebastian Albrecht mySebbe in WordPress Plugin Product Designer App versions = 1.1.3...

CVE-2024-51818

CVE-2024-51818 Fancy Product Designer = 6.4.3 - 未认证的 SQL 注入 描述 WordPress 的 Fancy Product Designer 插件在 6.4.3 及更早版本中存在 SQL 注入漏洞，原因是用户提供的参数未进行充分的转义，且现有 SQL 查询缺乏充分的预处理。这使得未经认证的攻击者能够将额外的 SQL 查询附加到已有查询中，从而提取数据库中的敏感信息。 详细信息 类型 ：插件 Slug ：fancy-product-designer 受影响版本 ：6.4.3 CVSS 分数 ：7.5 CVSS 评级 ：高 CVSS 向量...

WordPress Fancy Product Designer plugin <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by h0xilo in WordPress Plugin Fancy Product Designer versions = 6.5.2...

WordPress Fancy Product Designer plugin <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by h0xilo in WordPress Plugin Fancy Product Designer versions = 6.5.2...

WordPress Fancy Product Designer plugin <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by h0xilo in WordPress Plugin Fancy Product Designer versions = 6.5.2...

CVE-2026-84280

The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Order 'elements.title' Parameter in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers ...

EUVD-2026-86576

The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Order 'elements.title' Parameter in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers ...

CVE-2026-84280

The Fancy Product Designer plugin for WordPress (versions up to and including 6.5.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw stems from insufficient input sanitization and output escaping within the Shortcode Order 'elements[].title' parameter. An unauthenticated attacker c...

CVE-2026-84280 Fancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via Shortcode Order 'elements[].title' Parameter

The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Order 'elements.title' Parameter in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers ...

CVE-2026-84280 Fancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via Shortcode Order 'elements[].title' Parameter

The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Order 'elements.title' Parameter in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers ...

CVE-2026-84281

The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'productTitle' in 'fpddata' Order Item Meta in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...

CVE-2026-84279

The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'outputformat' parameter in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

EUVD-2026-86538

The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'outputformat' parameter in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-84279 Fancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via 'output_format' Parameter via Pro Export Print Job

The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'outputformat' parameter in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...