Unknown Bit Form vulnerabilities

5 CVEs affecting Unknown Bit Form, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-16573, published 2026-08-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-13693, published 2026-07-21. Medium severity, CVSS 5.9. EPSS: 0.4% chance of exploitation in the next 30 days. The Bit Form WordPress plugin before 3.1.0 does not restrict a form file-field value to a safe path before reading the file and attaching it to a notification email, allowing unauthenticated…
CVE-2026-16573, published 2026-08-05. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing unauthenticated attackers to upload a crafted SVG file containing JavaScript that…
CVE-2026-13694, published 2026-07-21. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated transient has expired, allowing unauthenticated attackers to re-trigger a form's…
CVE-2026-15054, published 2026-07-30. Low severity, CVSS 3.7. EPSS: 0.2% chance of exploitation in the next 30 days. The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated users to submit entries to, and fire the…
CVE-2025-15669, published 2026-08-01. Medium severity, CVSS 4.8. EPSS: 0.2% chance of exploitation in the next 30 days. The Bit Form WordPress plugin before 3.1.4 does not sanitise one of its conversational-form display settings before rendering it on the public-facing form, allowing high-privilege users (such as…