CVE-2026-16573 — Bit Form < 3.2.0 - Unauthenticated Stored XSS via SVG Signature Upload
The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing unauthenticated attackers to upload a crafted SVG file cont…
Published: 2026-08-05 · CVSS: 7.5 · CVSS 3.1
The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing unauthenticated attackers to upload a crafted SVG file containing JavaScript that executes when the file is viewed, leading to Stored Cross-Site Scripting.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7