CVEvulnerability

CVE-2026-89307

5.1 MEDIUM Published 2026-09-15 Modified 2026-09-18 Official page ↗

Status: Deferred
Published: 2026-09-15
Last modified: 2026-09-18
Assigner: a6d3dc9e-0591-4a13-bce7-0f5b31ff6158
CVSS 4.0 (a6d3dc9e-0591-4a13-bce7-0f5b31ff6158): 5.1 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weaknesses: CWE-601

Description

The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL (Stored HTML Injection / Open Redirect).

Weakness · CWE (1)

CWE-601 URL Redirection to Untrusted Site weakness

References

https://github.com/italia/design-scuole-wordpress-theme github.com
https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-nel-tema-wordpress-design-scuole-italia- www.acn.gov.it

CVE-2026-89307

Description

Related

Weakness · CWE (1)

References