The Bit Form WordPress plugin versions older than 3.2.0 fails to sanitize an uploaded signature image. An attacker can upload a crafted SVG file that contains malicious JavaScript. When a site user displays the image, the script runs in the victim’s browser context. This stored cross‑site scripting flaw can allow the execution of arbitrary client‑side code on any page that references the image.

Any WordPress site using the Bit Form plugin before version 3.2.0 is affected. The flaw is tied to the plugin’s signature upload feature, which accepts SVG files without validation.

The CVSS score of 7.5 classifies this as a high severity vulnerability, and the EPSS score of less than 1% indicates a low but non‑zero exploitation probability. The flaw is not listed in CISA’s KEV catalog. Because the upload endpoint is accessible without authentication, an unauthenticated attacker could inject an SVG file, after which the malicious code will execute whenever any visitor loads the stored image.