CVE-2026-87793— Reflected XSS in WordPress theme design-scuole-wordpress-theme
Quick assessment
Affected
Developers Italia design-scuole-wordpress-theme
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 主题“Design Scuole Italia”在 文件中存在反射型跨站脚本（XSS）漏洞。未经身份验证的攻击者可以通过构造包含恶意 参数的 URL，在受害者的浏览器中执行任意 JavaScript 代码。
Possible ATT&CK Techniques 2 AI
T1190 · Exploit Public-Facing Application T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-87793
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Reflected XSS in WordPress theme design-scuole-wordpress-theme
Source: CVE Program / CVE List V5
Vulnerability Description
The "Design Scuole Italia" WordPress theme is affected by a Reflected XSS vulnerability in the filters-scheda-didattica.php file,
allowing an unauthenticated attacker to execute arbitrary JavaScript in
a victim's browser via a crafted URL containing a malicious archive parameter.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Developers Italia | design-scuole-wordpress-theme | 1.0 ~ 2.18.2 | - |
|
II. Public POCs for CVE-2026-87793
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-87793
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-87793 (1)
-
🔗 Rilevate vulnerabilità nel tema WordPress “Design Scuole Italia” - ACN government-resource
Other References for CVE-2026-87793 (1)
Same Patch Batch · Developers Italia · 2026-09-15 · 4 CVEs total
| CVE-2026-87791 | 8.7 HIGH | Path traversal vulnerability in WordPress theme design-scuole-wordpress-theme |
| CVE-2026-87792 | 8.7 HIGH | Multiple authorization bypass in WordPress theme design-scuole-wordpress-theme |
| CVE-2026-89307 | 5.1 MEDIUM | HTML injection allows open redirection in WordPress theme design-scuole-wordpress-theme |
IV. Related Vulnerabilities
Same weakness: CWE-79
-
CVE-2026-81899
Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS via gr -
CVE-2026-18113
Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS in the -
CVE-2026-81898
Concrete CMS below version 9.5.3 is vulnerable to Stored XS -
CVE-2026-12749
Multiple security vulnerabilities are addressed with IBM Clo -
CVE-2026-12750
Multiple security vulnerabilities are addressed with IBM Clo
V. Comments for CVE-2026-87793
No comments yet