What is the CVSS score of CVE-2026-73375?

CVE-2026-73375 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Ultimate Maps Supsystic are affected by CVE-2026-73375?

The Ultimate Maps by Supsystic WordPress plugin (all versions before 1.5.0) contains an unauthenticated cross-site scripting vulnerability that enables attackers to inject malicious scripts into…. A patch is available.

How to fix or mitigate CVE-2026-73375?

Within 24 hours, inventory all WordPress installations to identify deployment of the Ultimate Maps by Supsystic plugin and assess the business criticality of affected sites. Immediately disable the plugin on systems where it is not essential to core operations. Within 7 days, identify and begin deployment of a replacement mapping solution, and implement Web Application Firewall rules to detect and block common XSS payload patterns if the plugin must remain temporarily in use. Within 30 days, complete migration away from the affected plugin and establish monitoring of the plugin repository for release of version 1.5.0 or later to enable re-evaluation of future patch availability.

Ultimate Maps Supsystic CVE-2026-73375

EUVD-2026-60790 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-18 Patchstack

GHSA-p37p-gp6p-9q27

WordPress XSS Wordpress Plugin Ultimate Maps By Supsystic Supsystic

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Unauthenticated network XSS with Changed scope requires victim interaction; no direct availability impact identified for a map-embed plugin.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Aug 18, 2026 - 15:02 EUVD

Analysis Generated

Aug 18, 2026 - 15:00 vuln.today

CVE Published

Aug 18, 2026 - 14:00 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions.

AnalysisAI

Unauthenticated Cross-Site Scripting in the Ultimate Maps by Supsystic WordPress plugin (all versions prior to 1.5.0) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages rendered in a victim's browser. The CVSS vector confirms a Changed scope (S:C), meaning injected scripts execute within the victim's browser security context rather than the plugin's own origin, enabling session hijacking or malicious redirection against authenticated WordPress users. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated, low-complexity attack vector significantly lowers the exploitation barrier.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause as insufficient sanitization or output encoding of user-controlled data before it is rendered as HTML. The affected product is the Ultimate Maps by Supsystic WordPress plugin, identified by CPE cpe:2.3:a:supsystic:ultimate_maps_by_supsystic:*:*:*:*:*:*:*:* (all versions before 1.5.0). This plugin provides Google Maps and similar mapping embeds for WordPress sites, and the unsanitized input is exposed without requiring any authentication, meaning any visitor to the WordPress site - or any external party who can deliver a crafted URL - can submit the malicious payload. The Changed scope metric (S:C) in the CVSS vector reflects the canonical XSS mechanism: the injected script executes within the victim's browser session, crossing the boundary from the plugin's WordPress context into the user's authenticated browser environment.

RemediationAI

Update the Ultimate Maps by Supsystic plugin to version 1.5.0 or later immediately, as this release is confirmed by Patchstack to resolve the XSS vulnerability (https://patchstack.com/database/wordpress/plugin/ultimate-maps-by-supsystic/vulnerability/wordpress-ultimate-maps-by-supsystic-plugin-1-5-0-cross-site-scripting-xss-vulnerability). If the update cannot be applied immediately, disable the plugin entirely to eliminate the attack surface - this removes all map embed functionality but eliminates exposure. As a temporary compensating control, deploying a Web Application Firewall rule targeting common XSS payloads in requests to plugin endpoints may reduce opportunistic exploitation risk, though WAF bypass is feasible and this measure should not be treated as a long-term substitute for patching. Enabling a restrictive Content Security Policy (CSP) header on the WordPress site can limit the impact of any successfully injected scripts by blocking inline script execution or restricting script origins, though misconfigurations can break legitimate plugin functionality.