Fancy Product Designer < 4.5.1 - Unauthenticated Stored Cross-Site Scripting

Fancy Product Designer for WooCommerce before version 4.5.1 permits the upload of unsanitized SVG files by unauthenticated users. SVG files can contain JavaScript which will be executed by the browser if the malicious SVG is accessed directly. This JavaScript will run in the context of the affected domain and logged in user.