The plugin contains a reflected XSS flaw in the 'day_from' and 'day_to' parameters. Unsanitized user input is reflected into the page output, letting an attacker inject malicious scripts. The injected code runs in the context of the victim’s browser, granting the attacker the ability to steal session data, deface the site, or insert further malicious content. Because the bug exists in all releases up to 0.1.2, any site running an affected version is at risk as soon as an attacker can lure an administrator to click a crafted link.

The vulnerable component is the WordPress plugin itsukaita, maintained by kazunii, in versions 0.1.2 and earlier. Sites that have installed or upgraded to any of those releases are impacted. Vendors or site operators using older versions should consider them compromised until remedied.

The CVSS base score of 6.1 indicates a moderate severity. No EPSS information is available, but the availability of the plugin on the public WordPress repository and the lack of authentication requirement make it likely that external attackers can exploit it. The vulnerability is not listed in the CISA KEV catalog. Adversaries typically deliver the exploit through a phishing or malicious link that, when followed by an administrator, triggers the reflected payload.