Lumise Product Designer CVE-2026-39726

Exploitation requires a vulnerable Lumise Product Designer plugin install at version 2.1.1 or earlier on a WordPress site, plus successful social engineering of a user into interacting with the attacker's crafted input/link (UI:R in the vector) - exploitation is not automatic. No authentication is needed (PR:N), so any remote actor can craft the payload, but the payload executes only in the context of a victim who triggers it. The primary limiting factors are the mandatory user interaction and the Low-severity C/I/A impacts; the specific vulnerable parameter/endpoint is not detailed in the available input.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1 High) describes an unauthenticated, network-reachable, low-complexity reflected/stored XSS with a scope change, consistent with CWE-79. The single mitigating signal in the vector is UI:R - a victim must be induced to interact (e.g., click a crafted link or load an attacker-influenced page), which prevents fully automated, self-propagating exploitation. No EPSS score, SSVC decision, KEV listing, or POC was supplied in the input; exploitation status is therefore 'no public exploit identified at time of analysis.' This is a genuine but moderate priority: XSS in a WordPress plugin is realistically exploitable, yet the impacts are only Low across C/I/A and gated by user interaction, so it is not a drop-everything issue. Missing-data caveat: EPSS and KEV are absent, so exploitation probability cannot be quantified; the only source is a single Patchstack advisory, so affected-version and fix data have not been independently cross-referenced against a vendor advisory or NVD CPE range beyond the wildcard CPE provided.

An unauthenticated attacker crafts a malicious link or input targeting a vulnerable Lumise Product Designer endpoint (<= 2.1.1) and lures a logged-in site user or administrator into opening it. The injected script executes in the victim's browser in the context of the WordPress site, enabling session/cookie theft, actions on the victim's behalf, or content manipulation. No public exploit code was identified at time of analysis, and successful exploitation depends on the required user interaction (UI:R).