CVE-2026-16573: Unknown Bit Form

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing unauthenticated attackers to upload a crafted SVG file containing JavaScript that executes when the file is viewed, leading to Stored Cross-Site Scripting.

Affected products

• Unknown Bit Form: before 3.2.0 (fixed in 3.2.0)

Published 2026-08-05. Last modified 2026-08-26.