LMS WordPress Theme CVE-2026-27404

Exploitation requires no authentication (PR:N) but does require user interaction (UI:R): a victim must open an attacker-crafted link or request targeting a reflected input parameter of the LMS theme on a site running version 9.7 or earlier. The limiting factors are that the payload is non-persistent (each victim must be individually lured to the malicious URL, so there is no self-propagation or broad stored effect), the target site must actually be running the vulnerable designthemes LMS theme, and impact is confined to the victim's browser session rather than direct server compromise.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) indicates network-reachable, low-complexity, unauthenticated exploitation, but critically requires user interaction (UI:R) - a victim must click or load an attacker-supplied link - which meaningfully lowers real-world exploitability compared to a no-interaction flaw. The scope change (S:C) reflects that injected script runs in the browser security context, but the confidentiality/integrity/availability impacts are each only Low. No EPSS score, KEV listing, or POC was provided in the source data, so there is no signal of active or automated exploitation; this reads as a genuine but moderate-priority issue typical of Patchstack theme XSS disclosures rather than an urgent internet-wide threat. Note a minor tension: reflected XSS rarely produces a true availability impact, so the A:L in the supplied vector is arguably generous.

An attacker crafts a URL to a site running the LMS theme with a malicious script embedded in a reflected parameter and delivers it via phishing email, forum post, or malicious ad. When a logged-in administrator or ordinary visitor opens the link, the theme reflects the payload into the page and the script executes in their browser, enabling session-token theft, CSRF-style actions, or redirection. No public POC was provided in the source data, and successful attack requires the victim to interact with the link (UI:R).