The design-scuole-wordpress-theme by Developers Italia contains a stored HTML injection vulnerability in the "Firma Circolare" feature. An authenticated attacker can supply malicious HTML via the sign parameter, which leads to an open redirect condition. This vulnerability is tracked as CVE-2026-89307 and affects versions >=1.0 <=2.17.3. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required beyond authentication, user interaction required, and low impact on confidentiality and integrity. No vendor advisory or patch information is available to confirm remediation status.

Successful exploitation allows an authenticated attacker to redirect users visiting the affected site to arbitrary attacker-controlled URLs. This can facilitate phishing or social engineering attacks by misleading users to malicious sites. The impact on confidentiality, integrity, and availability is low, but the forced redirection can undermine user trust and site integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to authenticated users who can use the "Firma Circolare" feature and monitor for suspicious redirection behavior. Avoid clicking on suspicious links involving the sign parameter.