CVE-2026-89307
Received Received - Intake

Stored HTML Injection via Sign Parameter in Design Scuole Italia WordPress Theme

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: ENISA

Description
The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL (Stored HTML Injection / Open Redirect).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-89307
EUVD
EUVD-2026-78668

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Stored HTML Injection and Open Redirect issue in the 'Firma Circolare' feature of the 'Design Scuole Italia' WordPress theme. An authenticated attacker can inject arbitrary HTML via the 'sign' parameter, which forces users to redirect to a URL controlled by the attacker.

Detection Guidance

To detect this vulnerability, inspect WordPress sites using the 'Design Scuole Italia' theme for the 'Firma Circolare' feature. Check for unusual HTML injection in the sign parameter or forced redirections to unknown URLs. Manually review theme files or use security plugins to scan for stored HTML injection.

Impact Analysis

If exploited, this vulnerability could allow attackers to redirect users to malicious websites, potentially leading to phishing attacks, malware downloads, or theft of sensitive information. Users visiting the affected site may unknowingly be sent to harmful destinations.

Compliance Impact

This vulnerability could lead to data breaches or unauthorized access, violating GDPR's data protection requirements and HIPAA's security rules. Organizations may face legal penalties, reputational damage, and loss of trust due to non-compliance.

Mitigation Strategies

Immediately update the 'Design Scuole Italia' WordPress theme to the latest patched version. If no patch is available, disable the 'Firma Circolare' feature or switch to a different theme. Regularly audit WordPress installations for unauthorized changes or suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89307. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart