CVE-2026-16573
Bit Form < 3.2.0 - Unauthenticated Stored XSS via SVG Signature Upload
Title source: cnaDescription
The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing unauthenticated attackers to upload a crafted SVG file containing JavaScript that executes when the file is viewed, leading to Stored Cross-Site Scripting.
References (1)
Core 1
Core References
Exploit exploit
vdb-entry
technical-description
https://wpscan.com/vulnerability/a102e6ba-02f3-46cf-b496-f129ea3d9c8f/
Scores
EPSS
0.0027
EPSS Percentile
18.6%
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
Status
published
Products (1)
None/Bit Form
< 3.2.0
Published
Aug 05, 2026
Tracked Since
Aug 05, 2026