EUVD-2025-210577
GHSA-wv7j-rf68-5jcq
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Admin-level write access required (PR:H), victim must load the form (UI:R), script executes in visitor browser context causing scope change (S:C), with limited confidentiality and integrity impact only.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Bit Form WordPress plugin before 3.1.4 does not sanitise one of its conversational-form display settings before rendering it on the public-facing form, allowing high-privilege users (such as administrators, who do not hold the unfiltered_html capability on multisite) to store JavaScript that executes in the browser of any visitor who views the form.
AnalysisAI
Stored cross-site scripting in the Bit Form WordPress plugin (versions before 3.1.4) allows administrator-level users to inject persistent JavaScript into a conversational-form display setting that then executes in the browser of any site visitor who views the affected form. The vulnerability is particularly relevant on WordPress multisite installations, where administrators do not hold the unfiltered_html capability and are therefore expected to be constrained to safe content - making this a bypass of that trust model. A public proof-of-concept exists per WPScan, though EPSS sits at 0.16% (6th percentile), suggesting negligible observed exploitation activity at time of analysis.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) covers stored XSS, the root cause here: the plugin fails to sanitize a conversational-form display configuration value before reflecting it in the public-facing HTML output. WordPress core ordinarily restricts unfiltered HTML output to users holding the unfiltered_html capability, which is withheld from administrators on multisite networks - this is an intentional security boundary. Bit Form does not apply its own sanitization layer on this specific setting, defeating that boundary. The affected component is identified by CPE cpe:2.3:a:unknown:bit_form:*:*:*:*:*:*:*:* covering all versions from 0 up to (not including) 3.1.4. The scope change in the CVSS vector (S:C) reflects that the injected script executes in the victim visitor's browser context rather than the WordPress application server context.
RemediationAI
Update the Bit Form WordPress plugin to version 3.1.4 or later; this is the vendor-released patch as confirmed by the WPScan advisory at https://wpscan.com/vulnerability/69800fa9-4fbd-489c-8759-96df745d77d6/. If immediate patching is not possible, restrict access to the WordPress admin panel to trusted IP ranges to limit who can modify conversational-form display settings - note this does not remove the stored payload if one has already been injected and requires a content audit of existing form configurations. On WordPress multisite networks, review whether administrator-level accounts are granted only to fully trusted parties; reducing admin account proliferation limits the exposure window. No workarounds exist that preserve full plugin functionality while blocking the injection point, so patching is the only complete remediation.
Stored Cross-Site Scripting in the Bit Form WordPress plugin before 3.2.0 enables unauthenticated attackers to upload cr
Unauthenticated workflow replay in the Bit Form WordPress plugin (versions before 3.1.0) allows external attackers to re
Path traversal in the Bit Form WordPress plugin (versions before 3.1.0) allows unauthenticated remote attackers to read
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bit Apps Bit Form Pro al
Unrestricted Upload of File with Dangerous Type vulnerability in Bit Apps Bit Form Pro allows Command Injection.6.4. Rat
Bit Form WordPress plugin before version 3.1.2 fails to enforce form deactivation state on its public submission handler
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Bit Apps Bit Form Pro.6.4. Rated medium seve
Incorrect Authorization vulnerability in Bit Apps Bit Form Pro bitformpro allows Accessing Functionality Not Properly Co
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form buil
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today