CVE-2025-1798: Design Comuni Italia WordPress Theme Unauthenticated Stored XSS

This post discloses a cross-site scripting (XSS) vulnerability I discovered in the “Design Comuni Italia” WordPress theme. This unauthenticated stored XSS vulnerability could potentially allow attackers to execute malicious JavaScript when administrators review user-submitted ratings. The vulnerability has been assigned CVE-2025-1798 with a CVSS score of 8.8 (High).

This vulnerability affects Design Comuni Italia theme versions below 1.11.2.

Vulnerability Overview

The vulnerable component is the ratings functionality present in many pages:

Image 1: The vulnerable rating component interface

The POST parameters affected by this vulnerability are radioResponse and freeText:

Image 2: The vulnerable POST parameters

An XSS payload inserted into either of these two parameters will be executed as soon as an authenticated user (typically an administrator) views the ratings via the WordPress dashboard at:

/wp-admin/edit.php?post_type=rating

Proof of Concept

PoC for the radioResponse parameter:

Image 3: Injection of XSS payload into radioResponse parameter

Image 4: Successful execution of radioResponse XSS payload

PoC for the freeText parameter:

Image 5: Injection of XSS payload into freeText parameter

Image 6: Successful execution of freeText XSS payload

Remediation

Update to version 1.11.2 or newer.

Conclusion

I responsibly disclosed this vulnerability to Developers Italia on January 21, 2025, and they promptly addressed it in a security release. Thanks to their team for the very fast response and resolution :) If for some reason you want to contact me, or just want to chat, DM me on X @0xDeco or send an e-mail