What is the CVSS score of CVE-2026-2427?

CVE-2026-2427 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-2427?

Organizations using all should be aware of moderate risk from CVE-2026-2427, a cross-site scripting vulnerability rated CVSS 6.1.

How to fix or mitigate CVE-2026-2427?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2026-2427

EUVD-2026-14176 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-21 Wordfence

GHSA-3mhc-gp96-mhpr

WordPress XSS

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14176

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

MEDIUM 6.1

DescriptionCVE.org

The itsukaita plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'day_from' and 'day_to' parameters in all versions up to, and including, 0.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link.

AnalysisAI

The itsukaita WordPress plugin contains a Reflected Cross-Site Scripting (XSS) vulnerability in the 'day_from' and 'day_to' parameters due to insufficient input sanitization and output escaping. All versions up to and including 0.1.2 are affected, allowing unauthenticated attackers to inject arbitrary web scripts that execute in administrator browsers if they click a malicious link. With a CVSS score of 6.1 (Medium) and a requirement for user interaction (UI:R), this vulnerability poses a moderate but real threat to WordPress installations using this plugin.

Technical ContextAI

The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic reflected XSS flaw. The itsukaita plugin (identified via CPE cpe:2.3:a:kazunii:itsukaita:*:*:*:*:*:*:*:*) fails to properly sanitize user-supplied input from the 'day_from' and 'day_to' query parameters before reflecting them in HTTP responses. WordPress plugins should implement wp_kses_post() or similar sanitization functions on input and use esc_attr() or esc_html() on output; the plugin source code at plugins.trac.wordpress.org/browser/itsukaita/trunk/itsukaita.php (line 55) and tags/0.1.2/itsukaita.php (line 55) demonstrates the absence of these protective measures. The vulnerability affects the parameter handling layer of the plugin, making it exploitable via crafted URLs.

RemediationAI

The primary remediation is to upgrade the itsukaita plugin to a patched version newer than 0.1.2 that includes proper input sanitization (wp_sanitize_text_field() or equivalent on 'day_from' and 'day_to' parameters) and output escaping (esc_attr() or esc_html()). Until a patched version is available, administrators should deactivate and remove the plugin immediately. As a temporary workaround, if the plugin is required, restrict access to the affected functionality via web server rules or WordPress security plugins (e.g., Wordfence) to block requests containing suspicious 'day_from' or 'day_to' parameters. Additionally, enforce Content Security Policy (CSP) headers to mitigate reflected XSS impact. Monitor the WordPress plugin repository (https://plugins.trac.wordpress.org) and Wordfence threat intelligence for patch availability.