CVE-2026-73378: WordPress Contact Form by Supsystic plugin < 1.10.0 - Cross Site Scripting (XSS) vulnerability
Published Aug 18, 2026
·Updated
Unauthenticated Cross Site Scripting (XSS) in Contact Form by Supsystic < 1.10.0 versions.
Affected Software
1 affected component
Supsystic WordPress Contact Form by Supsystic<1.10.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Contact Form by Supsysticto a version that resolves this vulnerability.Fixed in 1.10.0
Event History
Aug 18, 2026
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
Sites using Contact Form by Supsystic versions earlier than 1.10.0 are affected. The available data does not identify any configuration prerequisites or exclusions.
2
What does an attacker need to exploit this issue?
The vulnerability is unauthenticated, so an attacker does not need an account or prior privileges. Exploitation requires user interaction, as reflected by the UI:R vector.
3
What should be done to remediate the vulnerability?
Update Contact Form by Supsystic to version 1.10.0 or later. The provided data does not describe a workaround for sites that cannot update immediately.