The Bit integrations plugin fails to sanitize and escape user input in the field mapped to notification_content, allowing an attacker to embed arbitrary JavaScript that is stored and served to every page view that contains the injected content. This stored cross‑site scripting can compromise the confidentiality, integrity, and availability of all users who visit the vulnerable pages.

WordPress sites running Bit PressAdmin’s Bit integrations plugin, versions up to and including 2.10.6. The vulnerability exists in the public Bit Assist webhook callback that is used to trigger a BuddyBoss Send Notification action.

The CVSS score of 7.2 places this issue in the medium‑to‑high range, indicating significant potential damage if exploited. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, suggesting it may not yet be actively exploited. The attack requires that a site administrator has configured a public webhook flow that maps a form field to notification_content and that the attacker can learn the flow’s UUID callback URL. The likely attack vector is through this public webhook channel, with the attacker injecting the payload via the notification_content field. The path to exploitation is clear and does not require privileged access, making it relatively straightforward to achieve if the prerequisite conditions are met.