CVE-2026-16573

The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing unauthenticated attackers to upload a crafted SVG file containing JavaScript that executes when the file is viewed, leading to Stored Cross-Site Scripting...

PT-2026-66998

Name of the Vulnerable Software and Affected Versions Bit Form WordPress plugin versions prior to 3.1.4 Description Stored Cross-Site Scripting XSS occurs because the plugin fails to sanitize a conversational-form display setting before rendering it on the public-facing form. This allows...

CVE-2026-13694

The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated transient has expired, allowing unauthenticated attackers to re-trigger a form's configured workflow actions such as notification emails and integrations...