Bit Integrations EUVD-2026-98347

Exploitation is gated by a specific, non-default deployment: (1) a site administrator must have preconfigured a Bit Integrations flow that binds the public Bit Assist webhook trigger to a BuddyBoss 'Send Notification' action, (2) that flow must map an attacker-controllable form field to the notification_content parameter, and (3) the attacker must know the flow's secret UUID callback URL to reach the webhook endpoint. BuddyBoss must be installed and active alongside Bit Integrations ≤ 2.10.6. Given these preconditions, the injection request itself needs no authentication (PR:N) and no user interaction to be stored; a victim viewing the injected page then triggers execution. The chain of required admin configuration plus knowledge of the secret UUID materially limits realistic exploitation despite the unauthenticated network vector.

Signals conflict, and the conflict is the whole story. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N = 7.2 High) treats this as a trivially reachable network-based, unauthenticated stored XSS, which inflates the score. However, the description imposes a stacked chain of non-attacker-controlled preconditions: a site administrator must have already built a Bit Integrations flow binding the public Bit Assist webhook to a BuddyBoss 'Send Notification' action with a form field mapped to notification_content, AND the attacker must know the flow's secret UUID callback URL. These are real deployment and knowledge barriers that the AC:L rating does not reflect - in practice this behaves more like an AC:H condition. No EPSS score was supplied, there is no CISA KEV listing, and no POC is referenced, so there is no evidence of exploitation probability either way. Net assessment: this is a genuine but narrow, conditionally-exploitable issue rather than a mass-exploitation priority. It warrants prompt patching on sites that actually run the Bit Integrations + BuddyBoss notification flow, but the 7.2 'High' understates how much the required preconditions limit real-world exposure. Authentication requirement is confirmed as unauthenticated (PR:N) for the injection step itself.

On a WordPress site where an admin has wired a Bit Integrations flow from the public Bit Assist webhook into a BuddyBoss 'Send Notification' action mapping a form field to notification_content, an attacker who has learned the flow's UUID callback URL sends a crafted webhook request containing a JavaScript payload in that mapped field. Because input is not sanitized and output is not escaped, the script is stored inside the generated BuddyBoss notification and executes in the browser of any user who later views the affected page. No public exploit code is identified at time of analysis, and no authentication is required for the injection request.