CVE-2026-2431 is a reflected cross-site scripting vulnerability in the CM Custom Reports WordPress plugin by creativemindssolutions. The flaw exists in all versions up to and including 1.2.7, specifically in the handling of 'date_from' and 'date_to' parameters, which are not properly sanitized or escaped before being included in web pages. This allows an unauthenticated attacker to craft URLs that inject arbitrary JavaScript, potentially leading to session hijacking or other script-based attacks when a victim clicks the malicious link.

Successful exploitation can lead to the execution of arbitrary scripts in the context of the affected website, potentially compromising user sessions or performing actions on behalf of the user. The impact is limited to confidentiality and integrity with no direct availability impact. The vulnerability requires user interaction (clicking a crafted link) and no privileges or authentication are needed to exploit it.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable plugin or applying manual input validation and output escaping for the affected parameters. Monitor vendor channels for updates and apply patches promptly once released.