Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-16573

Bit Form < 3.2.0 - Unauthenticated Stored XSS via SVG Signature Upload

The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing unauthenticated attackers to upload a crafted SVG file containing JavaScript that executes when the file is viewed, leading to Stored Cross-Site Scripting.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Bit Form Wordpress
Products
Bit Form Wordpress
CVE-2025-15669

Bit Form < 3.1.4 - Admin+ Stored XSS via Conversational Form Progress Label

The Bit Form WordPress plugin before 3.1.4 does not sanitise one of its conversational-form display settings before rendering it on the public-facing form, allowing high-privilege users (such as administrators, who do not hold the unfiltered_html capability on multisite) to store JavaScript that executes in the browser of any visitor who views the form.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Bit Form Wordpress
Products
Bit Form Wordpress
CVE-2026-15054

Bit Form < 3.1.2 - Unauthenticated Inactive Form Submission

The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated users to submit entries to, and fire the configured workflows (such as email notifications) of forms the site owner has deactivated or unpublished.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Bit Form Wordpress
Products
Bit Form Wordpress