MEDIUM

CVE-2026-89307

2026-09-15 CVSS v4.0

CVSS

5.1

Description

The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL (Stored HTML Injection / Open Redirect).

Weakness (CWE)

CWE-601 Open Redirect

EPSS Score

0.28%

Probability of exploitation in next 30 days

21.1th percentile

References

https://github.com/italia/design-scuole-wordpress-theme https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-nel-tema-wordpress-design-scuole-italia-

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE