CVE-2026-2427

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The itsukaita plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'day_from' and 'day_to' parameters in all versions up to, and including, 0.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Mar 21, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-242709.8NVIDIA AIStore framework contains a vulnerability where an attacker could bypass authentication. A successful exploit of this vulnerability CVE-2026-242716.2NVIDIA TensorRT-LLM contains a vulnerability in the OpenAI-compatible inference API, where an attacker could cause allocation of GPU resourc CVE-2026-242727.8NVIDIA TensorRT contains a vulnerability where an attacker might cause an overflow to a heap-based buffer. A successful exploit of this vuln CVE-2026-24287.5The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to,CVE-2026-242817.4Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers wh CVE-2026-242825.5Out-of-bounds read in Push Message Routing Service allows an authorized attacker to disclose information locally.CVE-2026-242838.8Heap-based buffer overflow in Windows File Server allows an authorized attacker to elevate privileges locally.CVE-2026-242857.0Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.CVE-2026-242877.8External control of file name or path in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-242886.8Heap-based buffer overflow in Windows Mobile Broadband allows an unauthorized attacker to execute code with a physical attack.CVE-2026-242897.8Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-24294.9The Community Events plugin for WordPress is vulnerable to SQL Injection via the 'ce_venue_name' CSV field in the `on_save_changes_venues` f