{"id":"CVE-2026-89307","state":"PUBLISHED","title":"HTML injection allows open redirection in WordPress theme design-scuole-wordpress-theme","description":"The \"Firma Circolare\" feature in the \"Design Scuole Italia\" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL (Stored HTML Injection / Open Redirect).","publishedAt":"2026-09-15T15:23:40.292Z","updatedAt":"2026-09-15T17:31:45.292Z","severity":{"score":5.1,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","source":"ENISA"},"assigner":"ENISA","products":["Developers Italia design-scuole-wordpress-theme"],"affected":[{"vendor":"Developers Italia","product":"design-scuole-wordpress-theme","defaultStatus":"unaffected","versions":[{"version":"1.0","status":"affected","lessThanOrEqual":"2.17.3","versionType":"semver"}],"repo":"https://github.com/italia/design-scuole-wordpress-theme"}],"references":["https://github.com/italia/design-scuole-wordpress-theme","https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-nel-tema-wordpress-design-scuole-italia-"],"weaknesses":["CWE-601"],"ingestedAt":"2026-10-29T20:13:26.108Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/89xxx/CVE-2026-89307.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-89307","state":"PUBLISHED","datePublished":"2026-09-15T15:23:40.292Z","dateUpdated":"2026-09-15T17:31:45.292Z","assignerShortName":"ENISA","assignerOrgId":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","dateReserved":"2026-09-11T13:54:43.619Z"},"containers":{"cna":{"title":"HTML injection allows open redirection in WordPress theme design-scuole-wordpress-theme","descriptions":[{"lang":"en","value":"The \"Firma Circolare\" feature in the \"Design Scuole Italia\" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL (Stored HTML Injection / Open Redirect)."}],"affected":[{"vendor":"Developers Italia","product":"design-scuole-wordpress-theme","defaultStatus":"unaffected","versions":[{"version":"1.0","status":"affected","lessThanOrEqual":"2.17.3","versionType":"semver"}],"repo":"https://github.com/italia/design-scuole-wordpress-theme"}],"references":[{"url":"https://github.com/italia/design-scuole-wordpress-theme","tags":["product"]},{"url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-nel-tema-wordpress-design-scuole-italia-","tags":["government-resource"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"MEDIUM","baseScore":5.1,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-601","lang":"en","description":"CWE-601 URL redirection to untrusted site ('open redirect')","type":"CWE"}]}],"providerMetadata":{"shortName":"ENISA","orgId":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","dateUpdated":"2026-09-15T15:23:40.292Z"},"impacts":[{"capecId":"CAPEC-98","descriptions":[{"lang":"en","value":"CAPEC-98 Phishing"}]}],"cpeApplicability":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:developers_italia:design-scuole-wordpress-theme:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0","versionEndIncluding":"2.17.3"}]}]}],"credits":[{"lang":"en","value":"Lorenzo Zarfati","type":"finder"},{"lang":"en","value":"CSIRT-IT","type":"coordinator"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.4"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-89307","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-15T17:16:36.848070Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-15T17:31:45.292Z"}}]}}}