AUGUST 16, 2026
Live Feed
Back to database
Case File

CVE-2026-16573

HIGH · CVSS 7.5 EPSS 0.27%

Source: NVD + CISA KEV + EPSS · Published 2026-08-05 · Last synced 2026-08-16

CyberRota Analysis

AI-Generated

The Bit Form WordPress plugin prior to version 3.2.0 is vulnerable due to inadequate sanitization of uploaded signature images, enabling unauthenticated attackers to upload malicious SVG files that execute JavaScript upon viewing. This flaw can lead to Stored Cross-Site Scripting (XSS), potentially compromising user data and site integrity. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate the risk.

CVE
CVE-2026-16573
Severity
HIGH
CVSS
7.5
EPSS
0.27%
WordPress Java

Original NVD Description

The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing unauthenticated attackers to upload a crafted SVG file containing JavaScript that executes when the file is viewed, leading to Stored Cross-Site Scripting.