# CVE-2026-89307: Design Scuole Italia theme stored HTML injection and open redirect in Firma Circolare

Source: https://junglewise.ai/threats/cve-2026-89307-design-scuole-italia-theme-stored-html-injection-and-open  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-89307 · Severity: info · CVSS 5.1 · Published 2026-09-15

The Design Scuole Italia WordPress theme, used to power official websites for Italian schools, contains a feature called "Firma Circolare" (Circular Signature) that is vulnerable to stored HTML injection and open redirect attacks. An authenticated attacker can inject malicious HTML through an insufficiently validated parameter, causing the theme to redirect school staff and visitors to attacker-controlled URLs or inject harmful content into the page. This could compromise user sessions, steal credentials, or spread malware across school networks.

Technologies: [Italia Design Scuole Italia WordPress Theme](https://junglewise.ai/threats/technologies/design-scuole-italia-wordpress-theme). Vendors: [Italia](https://junglewise.ai/threats/vendors/italia).

## Quick answers

**Is CVE-2026-89307 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-89307 being exploited in the wild.

**How severe is CVE-2026-89307?** Informational severity, with a CVSS score of 5.1, published 15 September 2026.

**Which products and versions are affected?** Italia Design Scuole Italia WordPress Theme before 2.18.3.

**Is there a fix for CVE-2026-89307?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-89307 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-89307?** Check whether you run Italia Design Scuole Italia WordPress Theme at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stored HTML injection and open redirect flaw in the "Firma Circolare" feature of the Design Scuole Italia WordPress theme. It is caused by inadequate validation and sanitization of user input in the sign parameter, which is processed without proper output encoding. An authenticated attacker can craft malicious HTML or JavaScript payloads and inject them via the sign parameter; when other users access the affected resource, the stored payload executes in their browser, enabling session hijacking, credential theft, or forced redirection to attacker-controlled URLs. The attack requires user authentication to inject the payload, but no authentication is required for other users to trigger the stored payload. A patch is available in version 2.18.3 and later.

## Affected products

- Italia Design Scuole Italia WordPress theme before 2.18.3

## Timeline

- 2026-09-15: disclosed: Published by CSIRT Italia (Alert AL02/260915/CSIRT-ITA)
- 2026-09-15: advisory

## References

- [https://github.com/italia/design-scuole-wordpress-theme](https://github.com/italia/design-scuole-wordpress-theme)
- [https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-nel-tema-wordpress-design-scuole-italia-](https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-nel-tema-wordpress-design-scuole-italia-)

## Related threats

- [Design Scuole Italia WordPress theme authorization bypass in PDF/CSV generators](https://junglewise.ai/threats/cve-2026-87792-design-scuole-italia-wordpress-theme-authorization-bypass-in-pdf)
- [Design Scuole Italia path traversal in reserved_file_check](https://junglewise.ai/threats/cve-2026-87791-design-scuole-italia-path-traversal-in-reserved-file-check)