CVE-2026-89307: Developers Italia Design-Scuole-WordPress-Theme

Medium severity, CVSS 5.1. EPSS: 0.4% chance of exploitation in the next 30 days.

The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL (Stored HTML Injection / Open Redirect).

Affected products

• Developers Italia Design-Scuole-WordPress-Theme: from 1.0, up to and including 2.17.3

Published 2026-09-15. Last modified 2026-09-18.