CVE-2026-0753 is a reflected cross-site scripting vulnerability in the Super Simple Contact Form plugin for WordPress, affecting all versions up to and including 1.6.2. The issue stems from improper neutralization of input in the 'sscf_name' parameter, enabling unauthenticated attackers to inject malicious scripts that execute in the context of a victim's browser when they are tricked into clicking a crafted link or performing a similar action. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, no user interaction required, scope changed, and low impact on confidentiality and integrity with no impact on availability.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to information disclosure and integrity impacts such as session hijacking or unauthorized actions performed on behalf of the user. The vulnerability does not impact availability. There are no known exploits in the wild as per the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or replacing the Super Simple Contact Form plugin to mitigate risk. Additionally, applying web application firewall (WAF) rules that detect and block reflected XSS attempts targeting the 'sscf_name' parameter may provide temporary protection.