CVE-2026-39726: WordPress Lumise Product Designer plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability

Q: Does exploitation require an authenticated WordPress account?

No. The vulnerability is described as unauthenticated, so an attacker does not need a WordPress account or other prior privileges.

Q: Does exploitation require user interaction?

Yes. The CVSS vector includes UI:R, indicating that exploitation requires interaction from another user, such as causing a victim to load attacker-controlled content.

Q: What versions are known to be affected?

Lumise Product Designer versions 2.1.1 and earlier are identified as affected.

Q: What is the potential impact of successful exploitation?

Successful exploitation can affect confidentiality, integrity, and availability at low impact levels. The CVSS vector also indicates scope change, meaning the impact can extend beyond the vulnerable component's original security authority.

Published Oct 6, 2026

Updated

Unauthenticated Cross Site Scripting (XSS) in Lumise Product Designer <= 2.1.1 versions.

Affected Software

1 affected component

Lumise Lumise Product Designer<=2.1.1

Event History

Oct 6, 2026

CVE Published

via MITRE·08:34 AM

Data Sourced

via MITRE·08:34 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Does exploitation require an authenticated WordPress account?

No. The vulnerability is described as unauthenticated, so an attacker does not need a WordPress account or other prior privileges.

Does exploitation require user interaction?

Yes. The CVSS vector includes UI:R, indicating that exploitation requires interaction from another user, such as causing a victim to load attacker-controlled content.

What versions are known to be affected?