Executive brief
The Design Scuole Italia WordPress theme, used to power official websites for Italian schools, contains a feature called "Firma Circolare" (Circular Signature) that is vulnerable to stored HTML injection and open redirect attacks. An authenticated attacker can inject malicious HTML through an insufficiently validated parameter, causing the theme to redirect school staff and visitors to attacker-controlled URLs or inject harmful content into the page. This could compromise user sessions, steal credentials, or spread malware across school networks.
Technical details
The vulnerability is a stored HTML injection and open redirect flaw in the "Firma Circolare" feature of the Design Scuole Italia WordPress theme. It is caused by inadequate validation and sanitization of user input in the sign parameter, which is processed without proper output encoding. An authenticated attacker can craft malicious HTML or JavaScript payloads and inject them via the sign parameter; when other users access the affected resource, the stored payload executes in their browser, enabling session hijacking, credential theft, or forced redirection to attacker-controlled URLs. The attack requires user authentication to inject the payload, but no authentication is required for other users to trigger the stored payload. A patch is available in version 2.18.3 and later.
Affected products
- Italia Design Scuole Italia WordPress theme before 2.18.3
Timeline
- 2026-09-15: disclosed: Published by CSIRT Italia (Alert AL02/260915/CSIRT-ITA)
- 2026-09-15: advisory