A vulnerability was found in CM Custom Reports Plugin up to 1.2.7 on WordPress. It has been classified as problematic. The affected element is an unknown function. The manipulation of the argument date_from/date_to leads to cross site scripting.
This vulnerability is uniquely identified as CVE-2026-2431. The attack is possible to be carried out remotely. No exploit exists.
