Bit Form signature uploads permit unauthenticated stored XSS
Bit Form before 3.2.0 accepts a public form's uploaded signature image without sanitizing SVG content before storage. An unauthenticated submitter can upload an SVG containing JavaScript, which runs in the WordPress site origin when the stored file is viewed and can target administrative users who inspect submissions. This unscored record received deeper review because it combines an unauthenticated upload primitive with stored XSS. The CNA does not disclose the form endpoint, upload parameter or stored file path.
- Component
- Bit Form
- Plugin slug
bit-form- Affected
- < 3.2.0
- Safe version
3.2.0- Published
- Aug 05, 2026
This CVE was published Aug 05, 2026 and is one of 25 known issues for this plugin.
Update, patch or deactivate.
Update Bit Form to 3.2.0 or later. Remove untrusted SVG signature files and avoid opening historical signature uploads in a privileged browser session until they have been reviewed.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing unauthenticated attackers to upload a crafted SVG file containing JavaScript that executes when the file is viewed, leading to Stored Cross-Site Scripting.
CVE / CNA vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H