# CVE-2026-89307

## Summary

- **CVE ID:** CVE-2026-89307
- **Severity:** MEDIUM
- **CVSS Score:** 5.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N)
- **CWE:** CWE-601
- **Published:** Sep 15, 2026
- **Last Modified:** Sep 15, 2026

## Description

The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL (Stored HTML Injection / Open Redirect).

## Affected Products

- Developers Italia — design-scuole-wordpress-theme (1.0)

## References

- [CNA](https://github.com/italia/design-scuole-wordpress-theme)
- [CNA](https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-nel-tema-wordpress-design-scuole-italia-)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.28%
- **EPSS Percentile:** 20.9

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-18._