The Bit Form WordPress plugin fails to sanitize a conversational‑form display setting before rendering it to the public form page. This omission allows a user with administrator privileges to embed arbitrary JavaScript into the form progress label. When any visitor loads the form, the injected script executes in their browser, potentially leaking cookies, performing session hijacking, tricking users into submitting data, or defacing the site. The weakness corresponds to improper neutralization of input, matching CWE‑79.

WordPress sites running the Bit Form plugin version earlier than 3.1.4 are affected. All administrators of such installations can create the malicious form progress label that serves to store and deliver the XSS payload to visitors.

The vulnerability is classified as an XSS flaw with a CVSS score of 4.8, but the EPSS score is less than 1% and it is not listed in the CISA KEV catalog, indicating a relatively low probability of exploitation. Nevertheless, once deployed, the XSS payload runs in the context of every user who views the affected form. The attack requires an administrator to configure the malicious label, but does not need any special capability beyond standard admin rights, and it does not rely on default unfiltered_html capabilities in multisite installations.