CVE-2026-89307: HTML injection allows open redirection in WordPress theme design-scuole-wordpress-theme

Severity: medium (CVSS 5.1 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-15 · updated 2026-09-18
Weakness: CWE-601

Description

The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL (Stored HTML Injection / Open Redirect).

Affected products

Developers Italia design-scuole-wordpress-theme: from 1.0 through 2.17.3

References

https://github.com/italia/design-scuole-wordpress-theme
https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-nel-tema-wordpress-design-scuole-italia-

Get alerted when CVE-2026-89307 or the next vulnerability affects your stack