Executive brief
The Design Scuole Italia WordPress theme is used by Italian schools to build institutional websites. An unauthenticated attacker can trick a school administrator or visitor into clicking a malicious link, which executes arbitrary JavaScript in their browser. This could allow theft of session credentials, defacement of the website, or redirection to phishing pages.
Technical details
A Reflected XSS vulnerability exists in the filters-scheda-didattica.php file due to inadequate validation and sanitization of the "archive" URL parameter. The vulnerable parameter is reflected directly into the page without proper encoding or escaping. An unauthenticated attacker can craft a malicious URL containing JavaScript payload in the archive parameter and send it to victims via email or social media. When the victim visits the URL in their browser, the JavaScript executes in the context of their session, potentially allowing session hijacking, data theft, or further compromise. A patch is available in version 2.18.3 and later.
Affected products
- Italia Design Scuole WordPress Theme before 2.18.3
Timeline
- 2026-09-15: disclosed