LMS WordPress Theme CVE-2026-78532

Exploitation targets the designthemes 'LMS' WordPress theme at versions 8.3 and earlier and does not require authentication (PR:N), but it DOES require user interaction (UI:R): a victim must click a crafted link or load an attacker-controlled request that reflects the payload. The impact is scoped to code execution within the victim's browser session (S:C, C:L/I:L/A:L), not the server. Limiting factors that reduce realistic risk: the attacker cannot act without tricking a user into triggering the payload, the affected theme must be installed and active on the target WordPress site, and the site must be running version 8.3 or below.

This is a moderate-severity reflected/unauthenticated Cross-Site Scripting flaw (CWE-79) in the designthemes 'LMS' WordPress theme at versions <= 8.3, rated CVSS 7.1 via CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The vector signals network-reachable, low-complexity exploitation with no privileges required (PR:N, so unauthenticated), but it is gated by user interaction (UI:R) - a victim must be induced to trigger the payload, which caps real-world weaponizability. The changed scope (S:C) and low C/I/A impacts are consistent with XSS executing in a victim's browser rather than compromising the server directly. No EPSS score, CISA KEV entry, SSVC decision data, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: a genuine but not top-tier priority - the unauthenticated + network-vector profile makes it worth patching promptly on affected sites, yet the mandatory user interaction and browser-scoped impact place it below server-side RCE or auth-bypass classes. The absence of EPSS/KEV/POC signals means exploitation likelihood must be inferred from vector alone and cannot be confirmed from available data.

An attacker crafts a malicious URL or input targeting a vulnerable parameter in the designthemes LMS theme and lures a logged-in site visitor or administrator into clicking it. When the victim loads the page, unsanitized input reflects into the response and executes attacker-controlled JavaScript in their browser session, enabling session/cookie theft or actions in the victim's context. No public proof-of-concept was identified in the provided data, and the attack requires the victim to interact with the crafted request (UI:R).