Design Scuole Italia CVE-2026-89307

Exploitation requires an authenticated account (PR:L) with access to the 'Firma Circolare' feature of the Design Scuole Italia WordPress theme, and requires a victim to subsequently view the page containing the injected 'sign' parameter value (UI:P). The affected feature must be in use on the site, and the attacker must control the sign parameter input. Impact is limited to forced redirection / stored HTML injection with no confidentiality or availability effect. These factors - required authentication, required victim interaction, and dependence on the specific circular-signing feature - meaningfully limit real-world exploitability. Affected versions are 1.0 through 2.17.3.

This is a low-to-moderate priority issue whose signals are internally consistent and point away from urgency. The vendor CVSS 4.0 vector (5.1) encodes AV:N but PR:L and UI:P, meaning an authenticated (low-privilege) attacker must plant the payload and a victim must then interact with the affected content - this is not a drive-by remote flaw. Impact is limited to VI:L (integrity, low) with no confidentiality or availability effect (VC:N/VA:N), consistent with an open-redirect / stored HTML-injection primitive rather than code execution. CISA SSVC reinforces the low tier: Exploitation=none (no observed exploitation), Automatable=no (requires an authenticated actor and victim interaction, so it cannot be mass-sprayed), Technical Impact=partial. No EPSS score, no KEV listing, and no public POC were provided - absence of these is not itself a defect but leaves probability-of-exploitation unquantified. There are no conflicting signals here: a modest CVSS, benign SSVC, and no exploitation evidence all agree this is a real-but-low-severity bug appropriate for routine patching rather than emergency response. The one caveat is scope - a stored payload served to other site visitors could be argued as a scope/subsequent-system concern, but practical impact remains forced redirection.

An authenticated user with access to the 'Firma Circolare' (circular-signing) feature submits a crafted value in the 'sign' parameter containing HTML/redirect markup, which is stored and later rendered to other users. When a visitor loads the affected page, the injected content forces their browser to an attacker-controlled URL, enabling phishing or malware staging. No public exploit code was identified, and successful abuse still depends on a victim viewing the poisoned content (UI:P).