CVE-2026-89307

The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL (Stored HTML Injection / Open Redirect).

Score

CVSS 4.0 5.1 Medium

Status

Deferred - a6d3dc9e-0591-4a13-bce7-0f5b31ff6158

Published

2026-09-15

Last modified

2026-09-15

Weaknesses

CWE-601

Affected products

• Design-scuole-wordpress-theme (Developers Italia)

References

• https://github.com/italia/design-scuole-wordpress-theme
• https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-nel-tema-wordpress-design-scuole-italia-