Design Scuole Italia CVE-2026-87793

Exploitation requires that the Design Scuole Italia theme (design-scuole-wordpress-theme 1.0 through 2.18.2) be installed and active on a WordPress site, that filters-scheda-didattica.php be reachable over HTTP(S), and that a victim follow an attacker-supplied URL containing a malicious archive parameter. No authentication or account on the target is needed (CVSS PR:N), but successful compromise depends entirely on victim interaction (UI:A) - the payload is reflected, not stored, so it never persists on the server and each victim must click individually. Limiting factors: the flaw cannot be triggered by direct request without a human click, it cannot modify server-side state, and its impact is confined to the victim's browsing session on that origin (CVSS 4.0 SA:N). Sites that have deactivated the theme, blocked the file via WAF, or that render this template only for authenticated editors see materially reduced exposure.

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N) scores 5.1 - moderate - and is internally consistent: exploitation is remote and trivial to automate, requires no privileges, but needs victim interaction (UI:A) and yields only low confidentiality/integrity impact confined to the vulnerable system (SC/SI/SA:N). In CVSS 3.1 terms this maps to roughly 6.1 under S:C, which is the more conventional way to read XSS impact against WordPress admin sessions. No EPSS score, no KEV entry and no POC information were provided, so the real-world exploitation likelihood must be treated as unproven rather than low-risk-by-default: mass scanning for parameter reflection in WordPress themes is routine, and the Italian public-sector target set is small but high-visibility, which historically attracts both opportunistic and hacktivist attention. The absence of KEV listing despite a national CERT publication (ACN/ENISA) suggests coordinated disclosure rather than confirmed in-the-wild exploitation, but this is an inference, not a confirmed fact. Priority should be driven by whether the theme is actively serving public traffic rather than by the raw score.

An attacker crafts a URL pointing at filters-scheda-didattica.php on a school site running the theme, embedding a script payload in the archive parameter, and distributes it via email, social media or a shortened link to staff, students or administrators. When the victim clicks, the page is generated with the payload inline and the JavaScript executes in the school site's origin, allowing theft of session cookies or nonces, silent authenticated actions, or redirection to a credential-harvesting clone. Because the vector is reflected and requires no authentication or special position, the attack is fully automatable apart from the human click.