Skip to content
Sign in
4.8 Medium

CVE-2025-15669 The Bit Form WordPress plugin before 3.1.4 does not sanitise one of its conversational-form display settings before…

Description

The Bit Form WordPress plugin before 3.1.4 does not sanitise one of its conversational-form display settings before rendering it on the public-facing form, allowing high-privilege users (such as administrators, who do not hold the unfiltered_html capability on multisite) to store JavaScript that executes in the browser of any visitor who views the form.

Affected products and versions

Product Affected versions Fixed in
Bit Form 3.1 earliest → < 3.1.4 3.1.4

Other CVEs of Bit Form

The 6 CVEs of Bit Form →
CVE-2026-16573 The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing… 7.5 High CVE-2026-15054 The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public… 3.7 Low CVE-2026-13694 The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated… 6.5 Medium CVE-2026-13693 The Bit Form WordPress plugin before 3.1.0 does not restrict a form file-field value to a safe path before reading… 5.9 Medium
Track this CVE