Unauthenticated XSS is present in Lumise Product Designer plugin for WordPress versions up to 2.1.1. The flaw allows an attacker to supply crafted input that is reflected in browser output, enabling arbitrary JavaScript execution in the context of the site. If executed, this could lead to theft of user session cookies, defacement, and cross‑site request forgery against privileged users.

Lumise Product Designer (Lumise NEO) WordPress plugin is affected. All installations running version 2.1.1 or earlier are vulnerable, regardless of WordPress core version. The vulnerability is located in the plugin’s input handling code that does not properly sanitize user data before rendering.

The CVSS score of 7.1 classifies this as high severity, and the EPSS score of 0.00237 indicates a very low but nonzero probability of exploitation. Because the vulnerability does not require authentication, any web visitor can deliver the payload. The vectors involve an unauthenticated attacker crafting a request to the plugin’s exposed endpoint. Because the vulnerability is not listed in the CISA KEV catalog, no public exploits are currently known, but the nature of XSS makes it an attractive target for automated scanners.