7.5
High
CVE-2026-16573 The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing…
Description
The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing unauthenticated attackers to upload a crafted SVG file containing JavaScript that executes when the file is viewed, leading to Stored Cross-Site Scripting.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Bit Form 3.2 | earliest → < 3.2.0 | 3.2.0 |
Other CVEs of Bit Form
The 6 CVEs of Bit Form →
CVE-2025-15669
The Bit Form WordPress plugin before 3.1.4 does not sanitise one of its conversational-form display settings before…
4.8
Medium
CVE-2026-15054
The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public…
3.7
Low
CVE-2026-13694
The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated…
6.5
Medium
CVE-2026-13693
The Bit Form WordPress plugin before 3.1.0 does not restrict a form file-field value to a safe path before reading…
5.9
Medium