The Bit Form plugin for WordPress contains a stored cross‑site scripting flaw that arises when users upload SVG files. The plugin does not sufficiently sanitize the file content or escape output, allowing an authenticated user with Author or higher privileges to embed malicious scripts. When a victim subsequently views the SVG, the script runs in the victim’s browser, enabling session hijacking, credential theft, or defacement.

WordPress sites that have the Bit Form – Custom Contact Form, Multi Step, Conversational Form & Payment Form builder plugin installed in versions 2.18.3 or earlier. Any site that permits SVG uploads through this plugin is susceptible.

The vulnerability is rated with a CVSS score of 4.9, indicating moderate severity, and has an EPSS score of <1 %, meaning the likelihood of exploitation is low at present. It is not listed in the CISA KEV catalog. Exploitation requires authenticated access with Author‑level permissions, and the attack path involves uploading a crafted SVG file via the plugin’s file‑upload interface.