CVE-2026-89307CWE-601

CVE-2026-89307

published September 15, 2026

CVSS
5.1
EPSS
0%
Percentile
29.1
In the wild
Unconfirmed
What it is

The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL (Stored HTML Injection / Open Redirect).

The record
Technical detail
CVSS
5.1 · NONE
CVSS v4.0
5.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00364 · 29.1th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2026-09-15T20:17Z
References (2)
https://github.com/italia/design-scuole-wordpress-theme · a6d3dc9e-0591-4a13-bce7-0f5b31ff6158https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-nel-tema-wordpress-design-scuole-italia- · a6d3dc9e-0591-4a13-bce7-0f5b31ff6158
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 15 SEP 15:23Z
    HTML injection allows open redirection in WordPress theme design-scuole-wordpress-theme
    cvelistv5