CVE-2026-16573

UNKNOWN 0.0

Bit Form < 3.2.0 - Unauthenticated Stored XSS via SVG Signature Upload

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing unauthenticated attackers to upload a crafted SVG file containing JavaScript that executes when the file is viewed, leading to Stored Cross-Site Scripting.

Vendor	unknown
Product	bit form
Published	Aug 5, 2026

Stay Ahead of the Next One

Get instant alerts for unknown bit form

Be the first to know when new unknown vulnerabilities affecting unknown bit form are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Unknown / Bit Form

0 < 3.2.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/a102e6ba-02f3-46cf-b496-f129ea3d9c8f/

Credits

Abdullah Kareem (cyberkareem) WPScan