CVE-2026-16573 — Bit Form < 3.2.0 - Unauthenticated Stored XSS via SVG Signature Upload

CVE-2026-16573

Bit Form < 3.2.0 - Unauthenticated Stored XSS via SVG Signature Upload PUBLISHED

Description (CNA)

The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing unauthenticated attackers to upload a crafted SVG file containing JavaScript that executes when the file is viewed, leading to Stored Cross-Site Scripting.

Affected (CNA)

Vendor / product	Versions
Unknown / Bit Form	affected 0 before 3.2.0

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/a102e6ba-02f3-46cf-b496-f129ea3d9c8f/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.