CVE-2026-2427 is a reflected cross-site scripting vulnerability in the itsukaita WordPress plugin by kazunii, affecting all versions up to 0.1.2. The issue arises from improper neutralization of input in the 'day_from' and 'day_to' parameters, which are not adequately sanitized or escaped before being included in web pages. This allows unauthenticated attackers to inject malicious scripts that execute when an administrator interacts with a crafted URL. The vulnerability is rated medium severity with a CVSS 3.1 score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). There is no vendor advisory or patch information available, and the plugin is not a cloud service.

An attacker can perform reflected XSS attacks by injecting malicious scripts via specific URL parameters. This can lead to limited confidentiality and integrity impacts, such as theft of administrator session tokens or manipulation of web content in the administrator's browser context. Availability is not affected. Exploitation requires user interaction by an administrator, reducing the attack complexity somewhat. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on untrusted links containing the 'day_from' and 'day_to' parameters in the itsukaita plugin context. Consider disabling or removing the plugin if possible. Monitor vendor channels for updates or patches addressing this vulnerability.