Bit Form
Monthly
Stored Cross-Site Scripting in the Bit Form WordPress plugin before 3.2.0 enables unauthenticated attackers to upload crafted SVG files containing embedded JavaScript as signature images, which execute in a victim's browser upon viewing the submission. Any authenticated user - most critically a WordPress administrator - who reviews form submissions containing the malicious SVG is at risk of session hijacking or unauthorized administrative action. A public proof-of-concept is available per WPScan; however, EPSS stands at 0.18% (8th percentile) and CISA KEV does not list active exploitation, indicating real-world opportunistic exploitation has not been widely observed.
Stored cross-site scripting in the Bit Form WordPress plugin (versions before 3.1.4) allows administrator-level users to inject persistent JavaScript into a conversational-form display setting that then executes in the browser of any site visitor who views the affected form. The vulnerability is particularly relevant on WordPress multisite installations, where administrators do not hold the unfiltered_html capability and are therefore expected to be constrained to safe content - making this a bypass of that trust model. A public proof-of-concept exists per WPScan, though EPSS sits at 0.16% (6th percentile), suggesting negligible observed exploitation activity at time of analysis.
Bit Form WordPress plugin before version 3.1.2 fails to enforce form deactivation state on its public submission handlers, enabling unauthenticated network-accessible attackers to submit data to forms the site owner has intentionally disabled and trigger any configured backend workflows such as email notifications. The vulnerability carries a low CVSS score of 3.7 with AC:H, reflecting that exploitation requires knowledge of a specific deactivated form's endpoint, and real-world impact is limited to low integrity effects - spurious entries and unwanted workflow executions rather than data exfiltration or system compromise. A publicly available proof-of-concept exists per WPScan, though EPSS at 0.15% (5th percentile) indicates exploitation has not meaningfully materialized across the wild.
Unauthenticated workflow replay in the Bit Form WordPress plugin (versions before 3.1.0) allows external attackers to re-trigger any form's configured workflow actions - including notification emails and third-party service integrations - by submitting an expired workflow-trigger token that the plugin fails to properly reject. The root cause is missing authorization enforcement at the token-validation layer after WordPress transient expiry, classified under CWE-862. No public exploitation in CISA KEV is recorded, but a publicly available proof-of-concept exists per WPScan, elevating operational risk for sites with high-value workflow integrations such as CRM hooks or payment notifications.
Path traversal in the Bit Form WordPress plugin (versions before 3.1.0) allows unauthenticated remote attackers to read arbitrary files from the server - including wp-config.php, which contains database credentials and authentication keys - by supplying a crafted path in a form file-field that is then read and attached to a notification email. A publicly available proof-of-concept exploit exists, reported by WPScan, though the CVSS AC:H rating and SSVC Automatable:no designation indicate exploitation is not trivial. EPSS stands at 0.16% (6th percentile), and this CVE is not listed in CISA KEV, suggesting exploitation remains opportunistic rather than widespread at time of analysis.
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.17.4 via file uploads due to insufficient directory listing prevention and lack of randomization of file names. This makes it possible for unauthenticated attackers to extract sensitive data including files uploaded via a form. The vulnerability was partially patched in version 2.17.5.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Bit Apps Bit Form Pro.6.4. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Incorrect Authorization vulnerability in Bit Apps Bit Form Pro bitformpro allows Accessing Functionality Not Properly Constrained by ACLs.6.4. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unrestricted Upload of File with Dangerous Type vulnerability in Bit Apps Bit Form Pro allows Command Injection.6.4. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bit Apps Bit Form Pro allows File Manipulation.6.4. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stored Cross-Site Scripting in the Bit Form WordPress plugin before 3.2.0 enables unauthenticated attackers to upload crafted SVG files containing embedded JavaScript as signature images, which execute in a victim's browser upon viewing the submission. Any authenticated user - most critically a WordPress administrator - who reviews form submissions containing the malicious SVG is at risk of session hijacking or unauthorized administrative action. A public proof-of-concept is available per WPScan; however, EPSS stands at 0.18% (8th percentile) and CISA KEV does not list active exploitation, indicating real-world opportunistic exploitation has not been widely observed.
Stored cross-site scripting in the Bit Form WordPress plugin (versions before 3.1.4) allows administrator-level users to inject persistent JavaScript into a conversational-form display setting that then executes in the browser of any site visitor who views the affected form. The vulnerability is particularly relevant on WordPress multisite installations, where administrators do not hold the unfiltered_html capability and are therefore expected to be constrained to safe content - making this a bypass of that trust model. A public proof-of-concept exists per WPScan, though EPSS sits at 0.16% (6th percentile), suggesting negligible observed exploitation activity at time of analysis.
Bit Form WordPress plugin before version 3.1.2 fails to enforce form deactivation state on its public submission handlers, enabling unauthenticated network-accessible attackers to submit data to forms the site owner has intentionally disabled and trigger any configured backend workflows such as email notifications. The vulnerability carries a low CVSS score of 3.7 with AC:H, reflecting that exploitation requires knowledge of a specific deactivated form's endpoint, and real-world impact is limited to low integrity effects - spurious entries and unwanted workflow executions rather than data exfiltration or system compromise. A publicly available proof-of-concept exists per WPScan, though EPSS at 0.15% (5th percentile) indicates exploitation has not meaningfully materialized across the wild.
Unauthenticated workflow replay in the Bit Form WordPress plugin (versions before 3.1.0) allows external attackers to re-trigger any form's configured workflow actions - including notification emails and third-party service integrations - by submitting an expired workflow-trigger token that the plugin fails to properly reject. The root cause is missing authorization enforcement at the token-validation layer after WordPress transient expiry, classified under CWE-862. No public exploitation in CISA KEV is recorded, but a publicly available proof-of-concept exists per WPScan, elevating operational risk for sites with high-value workflow integrations such as CRM hooks or payment notifications.
Path traversal in the Bit Form WordPress plugin (versions before 3.1.0) allows unauthenticated remote attackers to read arbitrary files from the server - including wp-config.php, which contains database credentials and authentication keys - by supplying a crafted path in a form file-field that is then read and attached to a notification email. A publicly available proof-of-concept exploit exists, reported by WPScan, though the CVSS AC:H rating and SSVC Automatable:no designation indicate exploitation is not trivial. EPSS stands at 0.16% (6th percentile), and this CVE is not listed in CISA KEV, suggesting exploitation remains opportunistic rather than widespread at time of analysis.
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.17.4 via file uploads due to insufficient directory listing prevention and lack of randomization of file names. This makes it possible for unauthenticated attackers to extract sensitive data including files uploaded via a form. The vulnerability was partially patched in version 2.17.5.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Bit Apps Bit Form Pro.6.4. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Incorrect Authorization vulnerability in Bit Apps Bit Form Pro bitformpro allows Accessing Functionality Not Properly Constrained by ACLs.6.4. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unrestricted Upload of File with Dangerous Type vulnerability in Bit Apps Bit Form Pro allows Command Injection.6.4. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bit Apps Bit Form Pro allows File Manipulation.6.4. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.