CVE-2026-16573
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing unauthenticated attackers to upload a crafted SVG file containing JavaScript that executes when viewed, leading to Stored Cross-Site Scripting.
Risk Assessment
An attacker can steal user data, hijack sessions, or perform unauthorized actions in the context of logged-in users, potentially compromising data integrity and confidentiality.
Recommendation
Update the Bit Form plugin to version 3.2.0 or later, which includes the fix. Additionally, consider using a web application firewall (WAF) and conducting regular security audits.
Other vulnerabilities in Bit Form
See all- CVE-2026-14372High
The Bit Form plugin for WordPress up to version 3.1.1 is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFiles function. This allows authenticated attackers with subscriber-level access or higher to delete arbitrary files on the server.
- CVE-2025-15669Medium
The Bit Form WordPress plugin before 3.1.4 does not sanitise one of its conversational-form display settings before rendering it on the public-facing form, allowing high-privilege users (such as administrators, who do not hold the unfiltered_html capability on multisite) to store JavaScript that executes in the browser of any visitor who views the form.
- CVE-2026-13694Medium
The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated transient has expired, allowing unauthenticated attackers to re-trigger a form's configured workflow actions such as notification emails and integrations.
Original NVD description (English source)
The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing unauthenticated attackers to upload a crafted SVG file containing JavaScript that executes when the file is viewed, leading to Stored Cross-Site Scripting.