CVE-2026-89307

UNKNOWN

Description

The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL (Stored HTML Injection / Open Redirect).

Timeline

Published:September 15th, 2026 4:17 PM

Last modified:September 18th, 2026 7:24 PM

CVSS Scoring

No CVSS v3 score available

Weaknesses (CWE)

CWE-601

References & Reports

Advisories, patches, and third-party reports

https://github.com/italia/design-scuole-wordpress-theme
https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-nel-tema-wordpress-design-scuole-italia-

Source: NIST NVD · Data may lag official sources by up to one minute