CVE-2024-0902: Fancy Product Designer < 6.1.81 - Admin+ Cross Site Scripting via Product Title
The Fancy Product Designer WordPress plugin before 6.1.81 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0902?
CVE-2024-0902 has a high severity due to its potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2024-0902?
To fix CVE-2024-0902, update the Fancy Product Designer WordPress plugin to version 6.1.81 or later.
Who is affected by CVE-2024-0902?
CVE-2024-0902 affects users of the Fancy Product Designer WordPress plugin prior to version 6.1.81.
What type of vulnerability is CVE-2024-0902?
CVE-2024-0902 is a Stored Cross-Site Scripting vulnerability due to improper sanitization and escaping of settings.
What users are at risk with CVE-2024-0902?
High privilege users, such as administrators, are at risk with CVE-2024-0902 even if the unfiltered_html capability is disabled.