Plugin security history

Fancy Product Designer Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 16 vulnerability records associated with Fancy Product Designer, published between 2020 and 2025.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

16Total records

3Critical

5High

8Medium

0Low

0Informational

16Patched records

0Currently marked unpatched

2020-11-18First disclosure

2025-12-15Latest disclosure

15 of 16CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2020	1	1 records
2021	1	1 records
2022	2	2 records
2023	2	2 records
2024	4	4 records
2025	6	6 records

Severity Breakdown

Severity	Records	Share
Critical	3	18.8%
High	5	31.3%
Medium	8	50%

Vulnerability-Type Breakdown

Cross-Site Scripting

5 records31.3%

First: 2020. Latest: 2025.

SQL Injection

3 records18.8%

First: 2022. Latest: 2025.

Arbitrary File Upload

2 records12.5%

First: 2021. Latest: 2025.

Missing Authorization

2 records12.5%

First: 2023. Latest: 2023.

Information Disclosure

2 records12.5%

First: 2025. Latest: 2025.

CSRF

1 record6.3%

First: 2022. Latest: 2022.

Other

1 record6.3%

First: 2025. Latest: 2025.

Patch Status

Patched: 16
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

6.5.0
6.4.4
6.1.8
6.1.81
6.1.5
4.7.0
4.7.6
4.7.5
4.6.9
4.5.1

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-6.4.8`	Fancy Product Designer \| WooCommerce WordPress <= 6.4.8 - Unauthenticated Server-Side Request Forgery via Race Condition	December 15, 2025	6.5.0	Medium
`*-6.4.8`	Fancy Product Designer \| WooCommerce WordPress <= 6.4.8 - Unauthenticated Full Path Disclosure via 'pdf' Parameter	December 15, 2025	6.5.0	Medium
`*-6.4.8`	Fancy Product Designer \| WooCommerce WordPress <= 6.4.8 - Unauthenticated Information Disclosure and PHAR Deserialization via 'url' Parameter	December 15, 2025	6.5.0	Medium
`*-6.4.8`	Fancy Product Designer <= 6.4.8 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload	December 11, 2025	6.5.0	High
`*-6.4.3`	Fancy Product Designer <= 6.4.3 - Unauthenticated Arbitrary File Upload	January 3, 2025	6.4.4	Critical
`*-6.4.3`	Fancy Product Designer <= 6.4.3 - Unauthenticated SQL Injection	January 3, 2025	6.4.4	High
`*-6.1.7`	Fancy Product Designer <= 6.1.7 - Reflected Cross-Site Scripting	April 26, 2024	6.1.8	Medium
`[*, 6.1.81)`	Fancy Product Designer < 6.1.81 - Authenticated (Admin+) Stored Cross-Site Scripting via License Field	April 15, 2024	6.1.81	Medium
`[*, 6.1.81)`	Fancy Product Designer < 6.1.81 - Authenticated (Admin+) Stored Cross-Site Scripting via Product Title	March 25, 2024	6.1.81	Medium
`*-6.1.4`	Fancy Product Designer <= 6.1.4 - Authenticated (Admin+) SQL Injection	February 20, 2024	6.1.5	Critical
`*-4.6.9`	Fancy Product Designer <= 4.6.9 - Insufficient Authorization to Arbitrary Options Update via fpd_update_options	April 5, 2023	4.7.0	High
`*-4.6.9`	Fancy Product Designer <= 4.6.9 - Insufficient Authorization on Mulitple AJAX Actions	April 5, 2023	4.7.0	Medium
`*-4.7.5`	Fancy Product Designer <= 4.7.5 - Cross-Site Request Forgery to Arbitrary File Upload	April 14, 2022	4.7.6	High
`*-4.7.4`	Fancy Product Designer <= 4.7.4 - Admin+ SQL Injection	February 8, 2022	4.7.5	High
`[*, 4.6.9)`	Fancy Product Designer <= 4.6.8 - Unauthenticated Arbitrary File Upload	June 1, 2021	4.6.9	Critical
`*-4.5.0`	Fancy Product Designer <= 4.5.0 - Stored Cross-Site Scripting	November 18, 2020	4.5.1	Medium

Selected source records

Latest Records

MediumCVE-2025-13439

Fancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Information Disclosure and PHAR Deserialization via 'url' Parameter

Published: December 15, 2025

Affected versions: *-6.4.8
Patched versions: 6.5.0

Original Wordfence record

MediumCVE-2025-15526

Fancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Full Path Disclosure via 'pdf' Parameter

Published: December 15, 2025

Affected versions: *-6.4.8
Patched versions: 6.5.0

Original Wordfence record

MediumCVE-2025-13231

Fancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Server-Side Request Forgery via Race Condition

Published: December 15, 2025

Affected versions: *-6.4.8
Patched versions: 6.5.0

Original Wordfence record

HighCVE-2025-12570

Fancy Product Designer <= 6.4.8 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload

Published: December 11, 2025

Affected versions: *-6.4.8
Patched versions: 6.5.0

Original Wordfence record

HighCVE-2024-51818

Fancy Product Designer <= 6.4.3 - Unauthenticated SQL Injection

Published: January 3, 2025

Affected versions: *-6.4.3
Patched versions: 6.4.4

Original Wordfence record

CriticalCVE-2024-51919

Fancy Product Designer <= 6.4.3 - Unauthenticated Arbitrary File Upload

Published: January 3, 2025

Affected versions: *-6.4.3
Patched versions: 6.4.4

Original Wordfence record

MediumCVE-2024-0905

Fancy Product Designer <= 6.1.7 - Reflected Cross-Site Scripting

Published: April 26, 2024

Affected versions: *-6.1.7
Patched versions: 6.1.8

Original Wordfence record

MediumCVE-2024-0904

Fancy Product Designer < 6.1.81 - Authenticated (Admin+) Stored Cross-Site Scripting via License Field

Published: April 15, 2024

Affected versions: [*, 6.1.81)
Patched versions: 6.1.81

Original Wordfence record

Highest-Severity Records

CriticalCVE-2021-24370

Fancy Product Designer <= 4.6.8 - Unauthenticated Arbitrary File Upload

Published: June 1, 2021

Affected versions: [*, 4.6.9)
Patched versions: 4.6.9

Original Wordfence record

CriticalCVE-2024-51919

Fancy Product Designer <= 6.4.3 - Unauthenticated Arbitrary File Upload

Published: January 3, 2025

Affected versions: *-6.4.3
Patched versions: 6.4.4

Original Wordfence record

CriticalCVE-2024-0365

Fancy Product Designer <= 6.1.4 - Authenticated (Admin+) SQL Injection

Published: February 20, 2024

Affected versions: *-6.1.4
Patched versions: 6.1.5

Original Wordfence record

HighCVE-2021-4096

Fancy Product Designer <= 4.7.5 - Cross-Site Request Forgery to Arbitrary File Upload

Published: April 14, 2022

Affected versions: *-4.7.5
Patched versions: 4.7.6

Original Wordfence record

HighCVE-2021-4334

Fancy Product Designer <= 4.6.9 - Insufficient Authorization to Arbitrary Options Update via fpd_update_options

Published: April 5, 2023

Affected versions: *-4.6.9
Patched versions: 4.7.0

Original Wordfence record

HighCVE-2024-51818

Fancy Product Designer <= 6.4.3 - Unauthenticated SQL Injection

Published: January 3, 2025

Affected versions: *-6.4.3
Patched versions: 6.4.4

Original Wordfence record

HighCVE-2021-4134

Fancy Product Designer <= 4.7.4 - Admin+ SQL Injection

Published: February 8, 2022

Affected versions: *-4.7.4
Patched versions: 4.7.5

Original Wordfence record

HighCVE-2025-12570

Fancy Product Designer <= 6.4.8 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload

Published: December 11, 2025

Affected versions: *-6.4.8
Patched versions: 6.5.0

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory