The Bit Form WordPress plugin contains a critical stored cross-site scripting vulnerability that allows unauthenticated attackers to execute malicious JavaScript in user sessions.

This vulnerability involves inadequate input sanitization of signature images uploaded by users. An unauthenticated attacker can upload a crafted SVG file containing malicious JavaScript, which executes when the file is viewed by a victim.

This flaw carries a CVSS score of 7.5, indicating a high level of risk. Successful exploitation allows for the compromise of user sessions, potential data theft, and unauthorized actions performed on behalf of legitimate users, which could lead to privilege escalation within the WordPress environment.

Immediate Action: Update the Bit Form WordPress plugin to version 3.2.0 or later immediately to apply the necessary input sanitization patches.

Proactive Monitoring: Review web server and application access logs for suspicious file upload patterns or requests containing unexpected script tags.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block malicious SVG uploads or filter out script-based payloads in image parameters.

Public Exploit Available: Yes (public Proof of Concept exists)

Given the potential for session hijacking and the high CVSS severity, administrators should prioritize updating the Bit Form plugin. Ensure all signature upload forms are restricted to authorized users until the patch is successfully applied.