# CVE-2025-15669: Bit Apps Bit Form stored XSS in Conversational Form Progress Label

Source: https://junglewise.ai/threats/cve-2025-15669-bit-apps-bit-form-stored-xss-in-conversational-form-progress  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-01. Updated: 2026-08-01  
License: CC BY 4.0 with a link back

CVE-2025-15669 · Severity: info · CVSS 3.5 · Published 2026-08-01

Bit Form is a WordPress plugin used to create and manage interactive forms. A security vulnerability allows an administrative user to inject malicious scripts into the form's display settings. These scripts will then execute in the browsers of any website visitors who view the form, potentially leading to unauthorized actions or data theft.

Technologies: [Bit Apps Bit Form](https://junglewise.ai/threats/technologies/bit-form). Vendors: [Bit Apps](https://junglewise.ai/threats/vendors/bit-apps).

## Quick answers

**Is CVE-2025-15669 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-15669 being exploited in the wild.

**How severe is CVE-2025-15669?** Informational severity, with a CVSS score of 3.5, published 1 August 2026.

**Which products and versions are affected?** Bit Apps Bit Form < 3.1.4.

**Is there a fix for CVE-2025-15669?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-15669 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-15669?** Check whether you run Bit Apps Bit Form at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in the Bit Form plugin for WordPress due to insufficient sanitization of the 'Progress Label' setting within the Conversational Form component. An attacker with administrative privileges (or the 'manage_bitform' capability) can inject a malicious payload into the 'Progress Label' field. This payload is stored in the database and subsequently rendered without escaping on the public-facing form. When a visitor views the affected form, the script executes in their browser context. This is particularly relevant in multisite environments where administrators may not have the 'unfiltered_html' capability. The issue is fixed in version 3.1.4.

## Affected products

- Bit Apps Bit Form < 3.1.4

## Timeline

- 2026-07-17: disclosed: Publicly published by WPScan
- 2026-08-01: advisory: NVD publication date

## References

- [https://wpscan.com/vulnerability/69800fa9-4fbd-489c-8759-96df745d77d6/](https://wpscan.com/vulnerability/69800fa9-4fbd-489c-8759-96df745d77d6/)

## Related threats

- [Bit Apps Bit Form missing authorization for inactive form submission](https://junglewise.ai/threats/cve-2026-15054-bit-apps-bit-form-missing-authorization-for-inactive-form)
- [Bit Apps Bit Form authentication bypass in workflow trigger](https://junglewise.ai/threats/cve-2026-13694-bit-apps-bit-form-authentication-bypass-in-workflow-trigger)
- [Bit Apps Bit Form path traversal in file-field attachments](https://junglewise.ai/threats/cve-2026-13693-bit-apps-bit-form-path-traversal-in-file-field-attachments)
- [Bit Form WordPress Plugin arbitrary file deletion in deleteFiles](https://junglewise.ai/threats/cve-2026-14372-bit-form-wordpress-plugin-arbitrary-file-deletion-in-deletefiles)
- [Bit Apps BitForm Stored XSS in bitform shortcode](https://junglewise.ai/threats/cve-2026-8891-bit-apps-bitform-stored-xss-in-bitform-shortcode)