CVE-2026-16573

7.5 HIGH

Published 2026-08-05 · Updated 2026-08-05

AI risk analysis

Summary: The flaw allows unauthenticated attackers to upload a malicious SVG file containing JavaScript, leading to Stored Cross-Site Scripting (XSS). This matters because it can enable arbitrary code execution in users' browsers when they view the affected site.
Exploitability: Exploitation is relatively easy as no authentication is required. Attackers need access to the WordPress admin panel or file upload functionality.
Blast radius: If exploited, this could impact all users viewing the page containing the malicious SVG, potentially leading to data theft or further attacks via injected scripts.
Prioritized remediation: Update Bit Form WordPress plugin to version 3.2.0 or later immediately.

xsswp-pluginunauthsvg

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing unauthenticated attackers to upload a crafted SVG file containing JavaScript that executes when the file is viewed, leading to Stored Cross-Site Scripting.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses

CWE-79

All references

https://wpscan.com/vulnerability/a102e6ba-02f3-46cf-b496-f129ea3d9c8f/

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.