CVE-2026-73375

Executive Summary

CVE-2026-73375 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the Ultimate Maps by Supsystic plugin, affecting all versions prior to 1.5.0. A remote attacker can inject and execute arbitrary JavaScript in the context of a victim's browser session without holding any authenticated session on the target site. The vulnerability is rated High (CVSS 3.1 base score 7.1) and, while the direct confidentiality, integrity, and availability impacts are rated Low, the changed security scope expands the blast radius to the victim's full session with the WordPress application. No patch, vendor advisory, CISA KEV listing, or public exploit code is currently tracked, so exposure remains for all un-upgraded deployments.

Technical Analysis

The NVD description identifies the flaw as an unauthenticated Cross-Site Scripting (XSS) condition in Ultimate Maps by Supsystic, a map-building and publishing plugin distributed by Supsystic and commonly deployed on WordPress. No endpoint-level details are disclosed in the public description, meaning the precise injection point (whether a query-string parameter, an unauthenticated form field, or a stored value rendered on a publicly reachable page) has not been confirmed. The analysis below is therefore provided at the vulnerability-class level.

XSS (CWE-79) occurs when an application accepts attacker-controlled input and renders it as HTML or JavaScript without adequate validation or output encoding. In the unauthenticated variant, the attacker does not need to log in to deliver or store the malicious input. The typical mechanism is one of two patterns:

1. Reflected XSS — the attacker crafts a malicious URL containing a script payload in a parameter. When a victim clicks the link, the server reflects the payload into the response page without neutralization, and the browser executes it.
2. Stored XSS via unauthenticated surface — a publicly reachable endpoint (for example, a submission form or AJAX handler) stores attacker-controlled data that is later rendered to other users, including administrators, without sanitization.

The plugin's core purpose — rendering map configurations, markers, and user-supplied map data into HTML — makes both patterns plausible, as map configuration fields frequently allow rich text or URL values. The CVSS vector confirms the operational profile: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The attacker needs network access only (AV:N), faces low attack complexity (AC:L), requires no privileges (PR:N), but needs victim interaction (UI:R). The S:C (Scope: Changed) component is significant: the vulnerable component (the web application) is distinct from the impacted component (the victim's browser session). This explains why a Low/Low/Low impact rating still yields a High base score.

Patch confidence is 0/4 — no source tracked by this analysis has produced a patch, a patched version, or a vendor advisory. EPSS has not yet been scored by FIRST.org, and the CVE is not listed in CISA's Known Exploited Vulnerabilities catalog. The absence of exploit code today does not imply future absence; unauthenticated XSS in a widely deployed plugin is a high-value target for automated scanning and botnet-driven exploitation.

Exploitation Scenarios

Because no public PoC is available and the NVD description does not specify the injection parameter, the following attack chain is inferred from the vulnerability class and the CVSS profile. It should be treated as a representative model for detection and hunting, not as confirmed implementation detail.

Step 1 — Reconnaissance and target identification. An attacker identifies WordPress sites running the plugin using search-engine dorking or Internet-wide scanning platforms. Strings such as the plugin's vendor name ("supsystic") or the product's asset naming ("ultimate-maps") often appear in page HTML, CSS, or JavaScript references, allowing reliable fingerprinting. Targets of interest include sites whose map pages are visited by logged-in administrators, since those sessions carry the highest value.

Step 2 — Flaw triggering. The attacker constructs a crafted request that places an XSS payload into the unauthenticated input surface of the plugin. If the flaw is reflected, the payload travels in the query string or POST body and is echoed back into the rendered page. If the flaw is stored, the payload is submitted once through a public-facing form or API endpoint and is later served to any visitor of the affected page.

Step 3 — Payload execution. The victim must interact with the crafted content (UI:R). The attacker distributes a malicious link (phishing email, forum post, or messaging), or the victim simply browses to an already-poisoned page in the stored case. The browser executes the embedded JavaScript within the origin of the target WordPress site, granting the script full access to the page DOM, cookies, and any authenticated server-side requests the session permits.

Step 4 — Post-exploitation impact. The injected script can read session cookies (where the HttpOnly flag is absent), exfiltrate page content and tokens, impersonate the victim in same-origin requests, and alter page content for subsequent visitors. If the victim is an administrator, the script can invoke authenticated administrative actions — such as modifying site settings, injecting malicious content into posts, or creating rogue accounts — effectively yielding full site compromise. The script may also be used to stage phishing pages against the site's legitimate visitors.

No public PoC, Nuclei template, or exploit code is tracked for this CVE as of this report. SOCs should nonetheless assume that a working exploit is derivable from the vulnerability class, and should monitor for the payload signatures described below.

Impact Assessment

Affected systems: WordPress deployments running Ultimate Maps by Supsystic versions prior to 1.5.0. Because the plugin is an add-on rather than a core component, the vulnerable code is present only on sites where the plugin is installed and active; uninstalled copies pose no exposure.

Business impact: Successful exploitation creates a client-side compromise with server-side consequences. Direct impacts include theft of authenticated sessions, defacement of map pages and surrounding content, harvesting of visitor data, and distribution of malicious content to site visitors. The "changed scope" component of the CVSS vector means the attacker effectively pivots from the plugin's low-privilege context into the victim's entire session with the application. In the worst case — an administrator clicking a malicious link — the site itself can be taken over, leading to SEO poisoning, malware hosting, or supply-chain style watering-hole attacks against the site's audience.

Blast radius: The vulnerability is network-exploitable without authentication, so any site visitor or targeted user is a potential victim. The unpatched status compounds the risk: no mitigation exists from the vendor, and affected sites remain exposed indefinitely until an upgrade or compensating control is applied. The low individual impact scores (C:L/I:L/A:L) underestimate the practical severity because the most valuable target — the administrator session — is exactly the one an attacker will steer a victim toward. The absence of a CISA KEV listing and unscored EPSS indicate limited current in-the-wild reporting, but both metrics can change quickly once a PoC circulates.

Detection Guidance

The following detection logic identifies exploitation attempts at the vulnerability-class level. Organizations running the plugin should adapt the string supsystic to match the exact plugin slug and asset paths observed in their own deployments, and should merge these rules with their existing WordPress and web-firewall pipelines.

Sigma Rule

title: CVE-2026-73375 - Supsystic Ultimate Maps XSS Attempt
id: 1f3a9c42-7b5e-4e19-9d2a-5c6f0b7a91d1
status: experimental
description: Detects web requests referencing the Supsystic plugin combined with common XSS payload markers. Adjust URI field names to the local web server log schema.
logsource:
  category: webserver
  product: generic
detection:
  selection_plugin:
    cs-uri-query|contains:
      - 'supsystic'
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - 'onerror='
      - 'alert('
      - 'prompt('
      - 'javascript:'
      - '%3Cscript'
      - '&lt;script'
  condition: selection_plugin and selection_payload
falsepositives:
  - Legitimate map configuration values containing URL strings that resemble payloads
  - Security scanners and uptime monitors
level: medium

YARA Rule

rule CVE_2026_73375_Ultimate_Maps_Supsystic_XSS
{
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Matches web access log lines or HTTP payloads consistent with XSS probing of Ultimate Maps by Supsystic"
        cve = "CVE-2026-73375"
        date = "2026"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73375"
    strings:
        $plugin = "supsystic" ascii nocase
        $p1 = "<script" ascii nocase
        $p2 = "onerror=" ascii nocase
        $p3 = "alert(" ascii nocase
        $p4 = "prompt(" ascii nocase
        $p5 = "javascript:" ascii nocase
        $p6 = "%3Cscript" ascii nocase
        $p7 = "<svg" ascii nocase
        $p8 = "onload=" ascii nocase
    condition:
        $plugin and 2 of ($p*)
}

Suricata IDS Rule

alert http any any -> any any (
  msg:"CVE-2026-73375 - Supsystic Ultimate Maps Unauthenticated XSS Attempt";
  flow:established,to_server;
  content:"supsystic"; http.uri; nocase;
  pcre:"/(%3C|<)script|onerror\s*=|alert\s*\(|prompt\s*\(|javascript\s*:/i";
  classtype:web-application-attack;
  reference:cve,2026-73375;
  sid:20373375; rev:1;
)

For POST-based delivery, add a companion rule inspecting http.request_body with the same PCRE pattern. Tune the filter option (e.g., flowbits or destination port) to the organization's web-server topology to reduce false positives.

Elastic Detection

any where event.category == "web" and
  wildcard(url.path, "*supsystic*") and
  ( wildcard(url.query, "*<script*") or
    wildcard(url.query, "*onerror=*") or
    wildcard(url.query, "*alert(*") or
    wildcard(url.query, "*prompt(*") or
    wildcard(url.query, "*javascript:*") or
    wildcard(url.query, "*%3Cscript*") or
    wildcard(request.body.content, "*<script*") or
    wildcard(request.body.content, "*onerror=*") )

Splunk SPL Query

index=web sourcetype=access_combined
| regex uri="(?i)supsystic"
| regex uri="(?i)(%3C|<)script|onerror\s*=|alert\(|prompt\(|javascript:"
| stats earliest(_time) as first_seen latest(_time) as last_seen count by src_ip uri uri_query status user_agent

Adapt the field names (uri, uri_query) to the sourcetype used in your environment, and correlate the resulting source IPs against known scanner infrastructure.

Wazuh OSSEC Rule

<group name="web,web_application_attack,">
  <rule id="100733" level="10" frequency="5" timeframe="120" ignored="3">
    <if_matched_sid>31100</if_matched_sid>
    <description>CVE-2026-73375: XSS exploitation attempt against Ultimate Maps by Supsystic detected.</description>
    <field name="url">supsystic</field>
    <regex>(\%3Cscript|<script|onerror\s*=|alert\s*\(|prompt\s*\(|javascript:)</regex>
    <group>web_application_attack,xss,cve_2026_73375</group>
    <mitre>
      <id>T1189</id>
      <id>T1204.002</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch status: The patch confidence is 0/4 — this CVE is considered UNPATCHED. No vendor advisory, patched version, or source code fix has been identified from any tracked source. The affected version range is < 1.5.0; the title implies 1.5.0 is the resolving release, but this has not been verified and must not be assumed available.

1. Immediate mitigations:

• If the plugin is not business-critical, disable or uninstall it immediately until a patched release is confirmed.
• Deploy WAF rules that block requests combining plugin-identifying strings with XSS payload signatures (the Sigma/Suricata logic above can be ported to ModSecurity, AWS WAF, or Cloudflare).
• Enforce HttpOnly and Secure flags on session cookies to limit what an injected script can steal, and set appropriate Content-Security-Policy headers to block inline script execution.
• Restrict administrative access to the site (e.g., VPN or allowlist) to reduce the likelihood that an admin session becomes the exploitation target.

2. Patch / upgrade steps:

• Subscribe to Supsystic's plugin update channel and monitor the WordPress plugin repository for a release at or above 1.5.0.
• Before upgrading, test the new version in a staging environment that mirrors the production plugin configuration, then deploy through the standard WordPress update mechanism.
• Maintain a vulnerability-scanning process that flags the plugin name and version so remaining affected hosts are identified and tracked to completion.

3. Long-term hardening:

• Establish a plugin inventory with enforced update policies; third-party plugins are a leading entry point for unauthenticated attacks on WordPress.
• Apply input validation and output encoding at the application layer if in-house code interacts with the plugin's data.
• Monitor CISA KEV, EPSS, and vendor advisories for changes in exploitation status; prioritize rapid response if the CVE is subsequently exploited in the wild.
• Consider replacing the plugin with a maintained alternative if the vendor does not release a fix in a reasonable timeframe.

References

• NVD Entry — CVE-2026-73375: https://nvd.nist.gov/vuln/detail/CVE-2026-73375
• CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK — T1189 Drive-by Compromise: https://attack.mitre.org/techniques/T1189/
• CISA Known Exploited Vulnerabilities Catalog (CVE not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (score pending for this CVE): https://www.first.org/epss/

Threat-actor and in-the-wild status: No known threat-actor campaigns, exploit-in-the-wild reporting, or public exploit code is currently associated with CVE-2026-73375. The vulnerability remains unpatched, so this status should be re-evaluated regularly.