CVE-2025-2580

Contact Form by Bit Form <= 2.18.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

Published Apr 25, 2025 CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Description

The Contact Form by Bit Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.18.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.

Analysis

Technical impact

The Bit Form plugin for WordPress contains a stored cross‑site scripting flaw that arises when users upload SVG files. The plugin does not sufficiently sanitize the file content or escape output, allowing an authenticated user with Author or higher privileges to embed malicious scripts. When a victim subsequently views the SVG, the script runs in the victim’s browser, enabling session hijacking, credential theft, or defacement.

Affected Systems

WordPress sites that have the Bit Form – Custom Contact Form, Multi Step, Conversational Form & Payment Form builder plugin installed in versions 2.18.3 or earlier. Any site that permits SVG uploads through this plugin is susceptible.

Risk and Exploitability

The vulnerability is rated with a CVSS score of 4.9, indicating moderate severity, and has an EPSS score of <1 %, meaning the likelihood of exploitation is low at present. It is not listed in the CISA KEV catalog. Exploitation requires authenticated access with Author‑level permissions, and the attack path involves uploading a crafted SVG file via the plugin’s file‑upload interface.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

bitpressadmin

Bit Form – Custom Contact Form, Multi Step, Conversational Form & Payment Form builder

unaffected

Version	Status	Constraints
`0`	affected	≤ 2.18.3

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Bit Form plugin to version 2.18.4 or later, which removes the SVG upload vulnerability.
If an upgrade is not immediately possible, disable the SVG upload feature or restrict uploads to safe file types.
Implement input validation that rejects SVG files or sanitizes them to strip executable content, and enforce a Content Security Policy that blocks inline scripts from SVG resources.

Generated by OpenCVE AI on April 22, 2026 at 17:28 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-12399	The Contact Form by Bit Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.18.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.297% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/changeset/3271396/
https://wordpress.org/plugins/bit-form/#developers
https://www.wordfence.com/threat-intel/vulnerabilities/id/1f3b5d85-a8b0-43ac-b593-a61e20b9a4ca?source=cve

History

Apr 25, 2025 7:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 25, 2025 5:30 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Contact Form by Bit Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.18.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Title		Contact Form by Bit Form <= 2.18.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Weaknesses		CWE-79
References		https://plugins.trac.wordpress.org/changeset/3271396/ https://wordpress.org/plugins/bit-form/#developers https://www.wordfence.com/threat-intel/vulnerabilities/id/1f3b5d85-a8b0-43ac-b593-a61e20b9a4ca?source=cve
Metrics		cvssV3_1 `{'score': 4.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N'}`