{"id":"CVE-2026-89307","title":"The \"Firma Circolare\" feature in the \"Design Scuole Italia\" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL (St…","summary":"The \"Firma Circolare\" feature in the \"Design Scuole Italia\" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL (St…","severity":"medium","cvss":5.1,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","cwe":["CWE-601"],"vendor":"Developers Italia","product":"design-scuole-wordpress-theme","affected":["design-scuole-wordpress-theme >= 1.0 <= 2.17.3"],"published":"2026-09-15","updated":"2026-09-18","sourceUpdated":"2026-09-18T19:24:36.593","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89307","references":[{"url":"https://github.com/italia/design-scuole-wordpress-theme","label":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"},{"url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-nel-tema-wordpress-design-scuole-italia-","label":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"tags":["nvd","cve.org"],"epss":0.00283,"epssPercentile":0.21009,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-15T17:16:36.848070Z"},"cvssSource":"cna","ingestedAt":"2026-09-15T15:39:12.905Z","slug":"CVE-2026-89307","body":"## Overview\n\nThe \"Firma Circolare\" feature in the \"Design Scuole Italia\" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL (Stored HTML Injection / Open Redirect).\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":28.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}