Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-08-17
Bit Form - SQL Injection (CVE-2026-16810)
The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'data[queryCondition]' parameter in all versions up to, and including, 3.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Bit Form
CVE-2026-16810
Risk Score
Threat Entry
Updated 2026-08-26
Bit Form - Cross-Site Scripting (XSS) (CVE-2026-16573)
The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing unauthenticated attackers to upload a crafted SVG file containing JavaScript that executes when the file is viewed, leading to Stored Cross-Site Scripting.
PLUGIN
Bit Form
CVE-2026-16573
Risk Score
Threat Entry
Updated 2026-08-26
Bit Form - Cross-Site Scripting (XSS) (CVE-2025-15669)
The Bit Form WordPress plugin before 3.1.4 does not sanitise one of its conversational-form display settings before rendering it on the public-facing form, allowing high-privilege users (such as administrators, who do not hold the unfiltered_html capability on multisite) to store JavaScript that executes in the browser of any visitor who views the form.
PLUGIN
Bit Form
CVE-2025-15669
Risk Score
Threat Entry
Updated 2026-07-30
Bit Form - Security Vulnerability (CVE-2026-15054)
The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated users to submit entries to, and fire the configured workflows (such as email notifications) of forms the site owner has deactivated or unpublished.
PLUGIN
Bit Form
CVE-2026-15054
Risk Score
Threat Entry
Updated 2026-07-21
Bit Form - Security Vulnerability (CVE-2026-13694)
The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated transient has expired, allowing unauthenticated attackers to re-trigger a form's configured workflow actions such as notification emails and integrations.
PLUGIN
Bit Form
CVE-2026-13694
Risk Score
Threat Entry
Updated 2026-07-21
Bit Form - Security Vulnerability (CVE-2026-13693)
The Bit Form WordPress plugin before 3.1.0 does not restrict a form file-field value to a safe path before reading the file and attaching it to a notification email, allowing unauthenticated attackers to read arbitrary server files such as the WordPress configuration file.
PLUGIN
Bit Form
CVE-2026-13693
Risk Score
Threat Entry
Updated 2026-07-09
Bit Form - Remote Code Execution (CVE-2026-14372)
The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFiles function in all versions up to, and including, 3.1.1 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config).
PLUGIN
Bit Form
CVE-2026-14372
Risk Score
Threat Entry
Updated 2026-06-17
Bit Form - SQL Injection (CVE-2026-25418)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bit Apps Bit Form bit-form allows SQL Injection.This issue affects Bit Form: from n/a through
PLUGIN
Bit Form
CVE-2026-25418
Risk Score
Threat Entry
Updated 2026-06-17
Bit Form - Broken Access Control (CVE-2025-14901)
The Bit Form – Contact Form Plugin plugin for WordPress is vulnerable to unauthorized workflow execution due to missing authorization in the triggerWorkFlow function in all versions up to, and including, 2.21.6. This is due to a logic flaw in the nonce verification where the security check only blocks requests when both the nonce verification fails and the user is logged in. This makes it possible for unauthenticated attackers to replay form workflow executions and trigger all configured integrations including webhooks, email notifications, CRM integrations, and automation platforms via the…
PLUGIN
Bit Form
CVE-2025-14901
Risk Score
Threat Entry
Updated 2026-06-17
Bit Form - Remote Code Execution (CVE-2025-6679)
The Bit Form builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 2.20.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. For this to be exploitable, the PRO version needs to be installed and activated as well. Additionally a form with an advanced file upload element needs to be published.
PLUGIN
Bit Form
CVE-2025-6679
Risk Score
Threat Entry
Updated 2026-06-17
Bit Form - Information Disclosure (CVE-2024-13451)
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.17.4 via file uploads due to insufficient directory listing prevention and lack of randomization of file names. This makes it possible for unauthenticated attackers to extract sensitive data including files uploaded via a form. The vulnerability was partially patched in version 2.17.5.
PLUGIN
Bit Form
CVE-2024-13451
Risk Score
Threat Entry
Updated 2026-06-17
Bit Form - Cross-Site Scripting (XSS) (CVE-2025-2580)
The Contact Form by Bit Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.18.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
PLUGIN
Bit Form
CVE-2025-2580
Risk Score
Threat Entry
Updated 2026-06-17
Bit Form - Open Redirect (CVE-2025-30885)
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Bit Apps Bit Form bit-form allows Phishing.This issue affects Bit Form: from n/a through
PLUGIN
Bit Form
CVE-2025-30885
Risk Score
Threat Entry
Updated 2026-06-17
Bit Form - Server-Side Request Forgery (SSRF) (CVE-2024-13450)
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.17.4 via the Webhooks integration. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. The vulnerability can also be exploited in Multisite environments.
PLUGIN
Bit Form
CVE-2024-13450
Risk Score
Threat Entry
Updated 2026-06-17
Bit Form - Broken Access Control (CVE-2024-12190)
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the bitform-form-entry-edit endpoint in all versions up to, and including, 2.17.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view all form submissions from other users.
PLUGIN
Bit Form
CVE-2024-12190
Risk Score
Threat Entry
Updated 2026-06-17
Bit Form - Information Disclosure (CVE-2024-9507)
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 2.15.2 due to improper input validation within the iconUpload function. This makes it possible for authenticated attackers, with Administrator-level access and above, to leverage a PHP filter chain attack and read the contents of arbitrary files on the server, which can contain sensitive information.
PLUGIN
Bit Form
CVE-2024-9507
Risk Score
Threat Entry
Updated 2026-06-17
Bit Form - SQL Injection (CVE-2024-47335)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bit Apps Bit Form bit-form allows SQL Injection.This issue affects Bit Form: from n/a through
PLUGIN
Bit Form
CVE-2024-47335
Risk Score
Threat Entry
Updated 2026-06-17
Bit Form - Cross-Site Scripting (XSS) (CVE-2024-47301)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bit Apps Bit Form bit-form allows Stored XSS.This issue affects Bit Form: from n/a through
PLUGIN
Bit Form
CVE-2024-47301
Risk Score
Threat Entry
Updated 2026-06-17
Bit Form - Arbitrary File Upload (CVE-2024-47319)
Unrestricted Upload of File with Dangerous Type vulnerability in Bit Apps Bit Form bit-form.This issue affects Bit Form: from n/a through
PLUGIN
Bit Form
CVE-2024-47319
Risk Score
Threat Entry
Updated 2026-06-17
Bit Form - Information Disclosure (CVE-2024-43251)
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Bit Apps Bit Form Pro.This issue affects Bit Form Pro: from n/a through 2.6.4.
PLUGIN
Bit Form
CVE-2024-43251
Risk Score