CVE-2026-39726: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Lumise NEO Lumise Product Designer

CVE-2026-39726 is an improper neutralization of input during web page generation (CWE-79) vulnerability in Lumise Product Designer versions <= 2.1.1. It enables unauthenticated attackers to perform cross-site scripting (XSS) attacks, potentially leading to partial compromise of user data, session hijacking, or other malicious actions. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to partial disclosure of sensitive information, modification of data, and disruption of service within the Lumise Product Designer application. Because the vulnerability is unauthenticated and remotely exploitable, it poses a significant risk to users interacting with affected versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, users should apply any recommended vendor mitigations if published. Monitor the vendor's security advisories for updates.