CVE-2025-68596

WordPress Bit Assist plugin <= 1.5.11 - Broken Access Control vulnerability

Missing Authorization vulnerability in Bit Apps Bit Assist bit-assist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bit Assist: from n/a through <= 1.5.11.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bitapps Wordpress

Products

Bit Assist Wordpress

CVE-2023-51371

WordPress Bit Assist Plugin <= 1.1.9 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bit Assist Chat Widget: WhatsApp Chat, Facebook Messenger Chat, Telegram Chat Bubble, Line Messenger, Live Chat Support Chat Button, WeChat, SMS, Call Button, Customer Support Button with floating Chat Widget allows Stored XSS.This issue affects Chat Widget: WhatsApp Chat, Facebook Messenger Chat, Telegram Chat Bubble, Line Messenger, Live Chat Support Chat Button, WeChat, SMS, Call Button, Customer Support Button with floating Chat Widget: from n/a through 1.1.9.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Bitapps

Products

Bit Assist

CVE-2022-47599

WordPress File Manager Plugin <= 5.2.7 is vulnerable to PHP Object Injection

Deserialization of Untrusted Data vulnerability in File Manager by Bit Form Team File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager.This issue affects File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager: from n/a through 5.2.7.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Bitapps

Products

File Manager

CVE-2026-32519

WordPress Bit SMTP plugin <= 1.2.2 - Broken Authentication vulnerability

Incorrect Privilege Assignment vulnerability in Bit Apps Bit SMTP bit-smtp allows Privilege Escalation.This issue affects Bit SMTP: from n/a through <= 1.2.2.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Bitapps Wordpress

Products

Bit Smtp Wordpress

CVE-2024-47319

WordPress Bit Form plugin <= 2.13.10 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Bit Apps Bit Form bit-form.This issue affects Bit Form: from n/a through <= 2.13.10.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Bitapps

Products

Bit Form

CVE-2025-0821

Bit Assist <= 1.5.2 - Authenticated (Subscriber+) SQL Injection via id Parameter

Bit Assist plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Bitapps

Products

Bit Assist

CVE-2025-0822

Bit Assist <= 1.5.2 - Path Traversal to Authenticated (Subscriber+) Arbitrary File Read via fileID Parameter

Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the fileID Parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Bitapps

Products

Bit Assist

CVE-2024-8743

Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress <= 6.5.7 - Authenticated (Subscriber+) Limited JavaScript File Upload

The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to Limited JavaScript File Upload in all versions up to, and including, 6.5.7. This is due to a lack of proper checks on allowed file types. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an administrator, to upload .css and .js files, which could lead to Stored Cross-Site Scripting.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Bitapps

Products

File Manager

CVE-2024-1640

Contact Form Builder Plugin: Multi Step Contact Form, Payment Form, Custom Contact Form Plugin by Bit Form <= 2.10.1 - Unauthenticated Insecure Direct Object Reference to Form Submission Alteration

The Contact Form Builder Plugin: Multi Step Contact Form, Payment Form, Custom Contact Form Plugin by Bit Form plugin for WordPress is vulnerable to unauthorized modification of data due to a insufficient user validation on the bitforms_update_form_entry AJAX action in all versions up to, and including, 2.10.1. This makes it possible for unauthenticated attackers to modify form submissions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bitapps

Products

Contact Form Builder

CVE-2024-13450

Contact Form by Bit Form <= 2.17.4 - Authenticated (Administrator+) Server-Side Request Forgery

The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.17.4 via the Webhooks integration. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. The vulnerability can also be exploited in Multisite environments.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed

Vendors

Bitapps

Products

Contact Form Builder

CVE-2024-13451

Contact Form by Bit Form <= 2.17.5 - Unauthenticated Sensitive Information Exposure

The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.17.4 via file uploads due to insufficient directory listing prevention and lack of randomization of file names. This makes it possible for unauthenticated attackers to extract sensitive data including files uploaded via a form. The vulnerability was partially patched in version 2.17.5.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bitapps

Products

Bit Form

CVE-2024-7770

Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress <= 6.5.5 - Authenticated (Subscriber+) Arbitrary File Upload

The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload' function in all versions up to, and including, 6.5.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted upload permissions by an administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVSS 3.1 · 8.8 High EPSS 1.1% KEV · Not listed

Vendors

Bitapps Bitpressadmin

Products

File Manager Bit File Manager Wordpress

CVE-2024-13791

Bit Assist <= 1.5.2 - Path Traversal to Authenticated (Administrator+) Arbitrary File Read via downloadResponseFile Function

Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the downloadResponseFile() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Bitapps

Products

Bit Assist

CVE-2023-5907

File Manager < 6.3 - Admin+ Arbitrary OS File/Folder Access + Path Traversal

The File Manager WordPress plugin before 6.3 does not restrict the file managers root directory, allowing an administrator to set a root outside of the WordPress root directory, giving access to system files and directories even in a multisite setup, where site administrators should not be allowed to modify the sites files.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Bitapps

Products

File Manager

CVE-2023-3667

Bit Assist < 1.1.9 - Admin+ Stored Cross-Site Scripting

The Bit Assist WordPress plugin before 1.1.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Bitapps

Products

Bit Assist

CVE-2022-4774

Bit Form < 1.9 - RCE via Unauthenticated Arbitrary File Upload

The Bit Form WordPress plugin before 1.9 does not validate the file types uploaded via it's file upload form field, allowing unauthenticated users to upload arbitrary files types such as PHP or HTML files to the server, leading to Remote Code Execution.

CVSS 3.1 · 9.8 Critical EPSS 1.8% KEV · Not listed

Vendors

Bitapps

Products

Bit Form

CVE-2023-3645

Contact Form Builder by Bit Form < 2.2.0 - Admin+ Stored XSS

The Contact Form Builder by Bit Form WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Bitapps

Products

Contact Form Builder

CVE-2024-43251

WordPress Bit Form Pro plugin <= 2.6.4 - Authenticated Sensitive Data Exposure vulnerability

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Bit Apps Bit Form Pro.This issue affects Bit Form Pro: from n/a through 2.6.4.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Bitapps

Products

Bit Form

CVE-2024-7627

Bit File Manager 6.0 - 6.5.5 - Unauthenticated Remote Code Execution via Race Condition

The Bit File Manager plugin for WordPress is vulnerable to Remote Code Execution in versions 6.0 to 6.5.5 via the 'checkSyntax' function. This is due to writing a temporary file to a publicly accessible directory before performing file validation. This makes it possible for unauthenticated attackers to execute code on the server if an administrator has allowed Guest User read permissions.

CVSS 3.1 · 8.1 High EPSS 2.8% KEV · Not listed

Vendors

Bitapps

Products

File Manager

CVE-2024-43248

WordPress Bit Form Pro plugin <= 2.6.4 - Unauthenticated Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bit Apps Bit Form Pro allows File Manipulation.This issue affects Bit Form Pro: from n/a through 2.6.4.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Bitapps

Products

Bit Form Bit Form Pro