CVE-2026-87793: Reflected XSS in WordPress theme design-scuole-wordpress-theme
The "Design Scuole Italia" WordPress theme is affected by a Reflected XSS vulnerability in the filters-scheda-didattica.php file, allowing an unauthenticated attacker to execute arbitrary JavaScript in a victim's browser via a crafted URL containing a malicious archive parameter.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Edit the affected theme file `filters-scheda-didattica.php` (and both mentioned affected files) and replace `<?php echo $archive; ?>` with `<?php echo esc_attr($archive); ?>` to prevent reflected XSS through the `archive` parameter.
WordPress theme design-scuole-wordpress-theme (Design Scuole Italia) PHP output escaping in filters-scheda-didattica.php = replace `<?php echo $archive; ?>` with `<?php echo esc_attr($archive); ?>`
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker does not need to authenticate. They need to persuade a victim to open a crafted URL containing a malicious archive parameter.
What is the impact on a successful exploit?
The attacker can execute arbitrary JavaScript in the victim's browser. The issue is reflected XSS, so exploitation depends on a victim visiting the attacker-supplied URL.
Which component should be investigated?
Review deployments of the Design Scuole Italia WordPress theme, specifically the filters-scheda-didattica.php file and handling of the archive parameter.