Executive brief
Bit Form is a WordPress plugin used to create and manage interactive forms. A security vulnerability allows an administrative user to inject malicious scripts into the form's display settings. These scripts will then execute in the browsers of any website visitors who view the form, potentially leading to unauthorized actions or data theft.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in the Bit Form plugin for WordPress due to insufficient sanitization of the 'Progress Label' setting within the Conversational Form component. An attacker with administrative privileges (or the 'manage_bitform' capability) can inject a malicious payload into the 'Progress Label' field. This payload is stored in the database and subsequently rendered without escaping on the public-facing form. When a visitor views the affected form, the script executes in their browser context. This is particularly relevant in multisite environments where administrators may not have the 'unfiltered_html' capability. The issue is fixed in version 3.1.4.
Affected products
- Bit Apps Bit Form < 3.1.4
Timeline
- 2026-07-17: disclosed: Publicly published by WPScan
- 2026-08-01: advisory: NVD publication date