blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-89307

MEDIUM 5.1 CVSS 4.0
Published
September 15, 2026
Last modified
September 18, 2026
NVD status
Deferred
Reported by
a6d3dc9e-0591-4a13-bce7-0f5b31ff6158
Weakness
CWE-601
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Description

The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL (Stored HTML Injection / Open Redirect).

Affected products and versions

  • Developers Italia design-scuole-wordpress-theme — From 1.0 (including) to 2.17.3 (including)

References

  • github.com https://github.com/italia/design-scuole-wordpress-theme
  • www.acn.gov.it https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-nel-tema-wordpress-design-scuole-italia-
  • nvd.nist.gov Official NVD record