CVE-2026-73375
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Unauthenticated Cross Site Scripting (XSS) vulnerability in Ultimate Maps by Supsystic versions prior to 1.5.0.
Risk Assessment
An attacker can inject malicious script that executes in the user's browser, potentially leading to data theft or session hijacking.
Recommendation
Update the Ultimate Maps by Supsystic plugin to version 1.5.0 or later.
Other vulnerabilities in Ultimate Maps by Supsystic
See all- CVE-2026-102396High
The Ultimate Maps by Supsystic plugin versions 1.5.5 and earlier contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
- CVE-2026-73376Critical
Unauthenticated PHP Object Injection vulnerability in Ultimate Maps by Supsystic plugin versions before 1.5.0. An attacker without authentication can inject PHP objects, potentially leading to remote code execution.
- CVE-2026-85309Medium
Missing Authorization vulnerability in Supsystic Ultimate Maps by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ultimate Maps by Supsystic: from n/a through 1.5.3.
- CVE-2026-73377High
Unauthenticated Broken Access Control vulnerability in Ultimate Maps by Supsystic versions prior to 1.5.0.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS