CVE-2026-73378 is an unauthenticated Cross-Site Scripting (XSS) vulnerability classified under CWE-79 affecting the Contact Form by Supsystic plugin for WordPress. The issue exists in versions before 1.10.0, allowing attackers to inject malicious scripts into web pages generated by the plugin without requiring authentication. The vulnerability has a CVSS 3.1 base score of 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available to confirm remediation status.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary scripts in the context of the affected website, potentially leading to limited confidentiality and integrity loss, as well as partial availability impact. Since the vulnerability is unauthenticated, it can be exploited by any remote attacker without credentials. However, user interaction is required for the attack to succeed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the affected plugin or disabling it if feasible. Monitor official channels from Supsystic for updates and patches addressing this vulnerability.