Bit Form

WordPress plugin · bit-form · WordPress.org ↗

Critical

High

Known total

Unfixed

Running Bit Form on your site? WP Alerts checks your installed version against every entry below and emails you only when one affects you. Free, no tracking.

Scan a site Monitor my sites →

Severity	Vulnerability	Affected	Fixed in	CVE	Published
HIGH CVSS 7.5	Bit Form < 3.2.0 - Unauthenticated Stored XSS via SVG Signature Upload CVE.org	>=0, <3.2.0	v3.2.0	CVE-2026-16573	Aug 5, 2026
MEDIUM CVSS 4.8	Bit Form < 3.1.4 - Admin+ Stored XSS via Conversational Form Progress Label CVE.org	>=0, <3.1.4	v3.1.4	CVE-2025-15669	Aug 1, 2026
MEDIUM CVSS 5.9	Bit Form < 3.1.0 - Unauthenticated Arbitrary File Read via Path Traversal CVE.org	>=0, <3.1.0	v3.1.0	CVE-2026-13693	Jul 21, 2026
MEDIUM CVSS 6.5	Bit Form < 3.1.0 - Unauthenticated Workflow Trigger via Authentication Bypass CVE.org	>=0, <3.1.0	v3.1.0	CVE-2026-13694	Jul 21, 2026
LOW CVSS 3.7	Bit Form < 3.1.2 - Unauthenticated Inactive Form Submission CVE.org	>=0, <3.1.2	v3.1.2	CVE-2026-15054	Jul 30, 2026

Data aggregated from WPVulnerability, NVD/NIST, ENISA EUVD, CVE.org and WordPress.org. Provided as-is; verify with the plugin author before acting. Disclaimer.