4.8
Moyenne
CVE-2025-15669 The Bit Form WordPress plugin before 3.1.4 does not sanitise one of its conversational-form display settings before…
Description
The Bit Form WordPress plugin before 3.1.4 does not sanitise one of its conversational-form display settings before rendering it on the public-facing form, allowing high-privilege users (such as administrators, who do not hold the unfiltered_html capability on multisite) to store JavaScript that executes in the browser of any visitor who views the form.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Bit Form 3.1 | premières → < 3.1.4 | 3.1.4 |
Autres CVE de Bit Form
Les 6 CVE de Bit Form →
CVE-2026-16573
The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing…
7.5
Élevée
CVE-2026-15054
The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public…
3.7
Faible
CVE-2026-13694
The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated…
6.5
Moyenne
CVE-2026-13693
The Bit Form WordPress plugin before 3.1.0 does not restrict a form file-field value to a safe path before reading…
5.9
Moyenne