CVE-2026-87793 is a reflected XSS vulnerability in the Design Scuole Italia WordPress theme, specifically in the filters-scheda-didattica.php file. An attacker can exploit this by sending a crafted URL containing a malicious archive parameter, which executes arbitrary JavaScript in the victim's browser without requiring authentication. This vulnerability affects all theme versions from 1.0 through 2.18.2. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript code in the context of the victim's browser session when they visit a crafted URL. This can lead to session hijacking, defacement, or other client-side attacks. However, the vulnerability requires user interaction (clicking the malicious link) and has a low to limited scope of impact as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid clicking on suspicious or untrusted URLs containing the archive parameter in the affected theme. Site administrators should monitor official Developers Italia channels for updates or patches addressing this vulnerability.