Description (CNA)
The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL (Stored HTML Injection / Open Redirect).
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Developers Italia / design-scuole-wordpress-theme | affected 1.0 through 2.17.3 |
CWE
CWE-601
References
- https://github.com/italia/design-scuole-wordpress-theme
- https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-nel-tema-wordpress-design-scuole-italia-
ADP enrichment
No English description supplied.
No references supplied.