21831 matches found
CVE-2026-87792
The "Design Scuole Italia" WordPress theme is affected by multiple Authorization Bypass vulnerabilities in the dsipdfgenerator and dsicsvgenerator functions, allowing an unauthenticated attacker to access restricted "Circolare" content and registered users' data. An unauthenticated RSS feed...
CVE-2026-87793
The "Design Scuole Italia" WordPress theme is affected by a Reflected XSS vulnerability in the filters-scheda-didattica.php file, allowing an unauthenticated attacker to execute arbitrary JavaScript in a victim's browser via a crafted URL containing a malicious archive parameter...
CVE-2026-89307 HTML injection allows open redirection in WordPress theme design-scuole-wordpress-theme
The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL Stored HTML Injection / Open Redirect...
EUVD-2026-78668
The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL Stored HTML Injection / Open Redirect...
CVE-2026-89307
CVE-2026-89307 affects the Design Scuole Italia WordPress theme (versions 1.0–2.17.3 ). The "Firma Circolare" feature allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling a stored HTML injection that forces visiting users to redirect to an attacker-controlled...
EUVD-2026-78666
The "Design Scuole Italia" WordPress theme is affected by a Reflected XSS vulnerability in the filters-scheda-didattica.php file, allowing an unauthenticated attacker to execute arbitrary JavaScript in a victim's browser via a crafted URL containing a malicious archive parameter...
CVE-2026-87793 Reflected XSS in WordPress theme design-scuole-wordpress-theme
The "Design Scuole Italia" WordPress theme is affected by a Reflected XSS vulnerability in the filters-scheda-didattica.php file, allowing an unauthenticated attacker to execute arbitrary JavaScript in a victim's browser via a crafted URL containing a malicious archive parameter...
CVE-2026-87793
The "Design Scuole Italia" WordPress theme (versions 1.0–2.18.2 ) contains a Reflected Cross-Site Scripting (XSS) vulnerability in the filters-scheda-didattica.php file. An unauthenticated attacker can execute arbitrary JavaScript in a victim's browser by supplying a malicious value in the archiv...
CVE-2026-87792 Multiple authorization bypass in WordPress theme design-scuole-wordpress-theme
The "Design Scuole Italia" WordPress theme is affected by multiple Authorization Bypass vulnerabilities in the dsipdfgenerator and dsicsvgenerator functions, allowing an unauthenticated attacker to access restricted "Circolare" content and registered users' data. An unauthenticated RSS feed...
CVE-2026-87792
The "Design Scuole Italia" WordPress theme (versions 1.0–2.17.3 ) is affected by multiple Authorization Bypass vulnerabilities in the dsi_pdf_generator and dsi_csv_generator functions. An unauthenticated attacker can access restricted "Circolare" content and registered users' data; an unauthentic...
EUVD-2026-78665
The "Design Scuole Italia" WordPress theme is affected by multiple Authorization Bypass vulnerabilities in the dsipdfgenerator and dsicsvgenerator functions, allowing an unauthenticated attacker to access restricted "Circolare" content and registered users' data. An unauthenticated RSS feed...
CVE-2026-87791 Path traversal vulnerability in WordPress theme design-scuole-wordpress-theme
A path traversal vulnerability exists in the reservedfilecheck function of the functions.php file in the WordPress Design Scuole Italia theme. The vulnerability allows an unauthenticated attacker to download arbitrary files accessible by the web server process...
CVE-2026-87791
A path traversal vulnerability in the reserved_file_check function of functions.php in the WordPress Design SCUOLE Italia theme (versions 2.6.0–2.18.1 ) allows an unauthenticated attacker to download arbitrary files accessible by the web server process. The CVSS 4.0 base score is 8.7 (HIGH) , ref...
CVE-2026-15609
The Bridge - Creative Multipurpose WordPress Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'circleline' Shortcode Attribute in all versions up to, and including, 30.8.9.1 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-14805 Consulting - Business, Finance WordPress Theme <= 6.7.16 - Authenticated (Subscriber+) Privilege Escalation via AJAX
The Consulting theme for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 6.7.16. This is due to a combination of two flaws: 1 the masterstudymsstmsetdiscardtransient AJAX endpoint in admin/admin-notices/classes/STMHandler.php accepts an arbitrary transient key...
CVE-2026-15609 Bridge - Creative Multipurpose WordPress Theme <= 30.8.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'circle_line' Shortcode Attribute
The Bridge - Creative Multipurpose WordPress Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'circleline' Shortcode Attribute in all versions up to, and including, 30.8.9.1 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-89307
creationtimestamp| type| source ---|---|--- 2026-09-15 08:45:14+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-nel-tema-wordpress-design-scuole-italia-...
CVE-2026-87792
creationtimestamp| type| source ---|---|--- 2026-09-15 08:45:12+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-nel-tema-wordpress-design-scuole-italia-...