CVE-2026-89307 — HTML injection allows open redirection in WordPress theme design-scuole-wordpress-theme
The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced red…
Published: 2026-09-15 · CVSS: 5.1 · CVSS 4.0
The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL (Stored HTML Injection / Open Redirect).
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7