The Bitly WordPress plugin version 2.8.0 or earlier contains an improper neutralization of input during web page generation that permits an attacker to inject malicious script code. An attacker can store script in a form field, and the code will be rendered in the browser of any user who views the generated page, allowing the attacker to steal cookies, hijack sessions, or perform other client‑side actions. The vulnerability is a classic example of the input‑validation weakness listed as CWE‑79.

The vulnerable component is the Bitly provider’s WordPress plugin, distributed under the name Bitly by bitlydeveloper. All installations of this plugin with a version equal to or older than 2.8.0 are affected, including earlier releases. The plugin is commonly deployed on WordPress sites that use the Bitly share integration.

The CVSS score of 6.5 marks it as a medium‑severity flaw. The EPSS value of less than 1% indicates that, as of now, it appears to be a low‑probability target for active exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would likely involve the attacker submitting malicious input through the plugin’s user‑facing interface, which is then stored and rendered for all site visitors. Because the attack vector requires any user to submit data that is later displayed, the opportunity is limited to sites that allow untrusted input to be stored.