High · 7.1 CVE-2026-39726 EUVD-2026-93248GHSA-hm4m-p66c-wcrw

WordPress Lumise Product Designer plugin < 2.1.4.1 - Cross Site Scripting (XSS) vulnerability

Published Oct 6, 2026 · Updated Nov 5, 2026 · Assigned by Patchstack

Vendor: Lumise Product: Lumise Product Designer

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lumise Lumise Product Designer lumise allows Reflected XSS.This issue affects Lumise Product Designer: from n/a before 2.1.4.1.

Affected products

Vendor	Product	Affected	Fixed
Lumise	Lumise Product Designer	< 2.1.4.1	2.1.4.1

References

https://patchstack.com/database/wordpress/plugin/lumise/vulnerability/wordpress-lumise-product-designer-plugin-2-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve vdb-entry