Contact Form Supsystic CVE-2026-73378

No authentication is required to submit input to the contact form (confirmed by PR:N in the CVSS vector). However, exploitation requires that a victim user (site visitor, editor, or administrator) subsequently loads a page rendering the malicious input, as indicated by UI:R in the CVSS vector. Limiting factors include: the target WordPress site must have the Contact Form by Supsystic plugin installed and active in a version prior to 1.10.0; a real user must interact with or navigate to the page containing the injected content before the script executes; and the attacker cannot directly control when or whether a victim will trigger the payload. The attack does not require any non-default configuration of the plugin - any site with a publicly accessible contact form is exposed.

The CVSS 7.1 score is driven by a favorable-to-attacker combination of network accessibility, low complexity, and no required privileges (AV:N/AC:L/PR:N), moderated by the need for victim interaction (UI:R) and relatively low individual impact metrics (C:L/I:L/A:L). No EPSS score, CISA KEV listing, or confirmed proof-of-concept code is referenced in the available intelligence, which collectively suggests this has not yet been observed in active, widespread exploitation campaigns. The A:L availability metric in the provided CVSS vector warrants scrutiny - traditional XSS does not directly impair service availability, and this metric may modestly inflate the composite score. That said, even a mid-sized municipal IT team in mielec running a public WordPress site with this plugin installed should treat the patch as near-term rather than deferrable, given the zero-privilege entry point and the real potential for session theft or phishing via script injection. The absence of KEV listing should not be read as safety: unauthenticated, network-reachable XSS in a publicly accessible contact form is a straightforward target for opportunistic attackers.

An unauthenticated attacker visits a WordPress site running Contact Form by Supsystic before version 1.10.0 and submits a contact form containing a crafted XSS payload in one of the input fields. The plugin stores or reflects the unsanitized input, and when a site visitor or administrator subsequently loads the affected page, the malicious script executes in their browser, potentially exfiltrating session cookies or WordPress nonces to an attacker-controlled server. No proof-of-concept code has been identified at time of analysis, but the attack pattern is well-understood and trivially reproducible for any attacker familiar with WordPress plugin XSS techniques.