PatchSiren

Bit Form CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

Review Bit Form CVE published 2026-08-01

CVE-2025-15669

The Bit Form WordPress plugin before 3.1.4 does not sanitise one of its conversational-form display settings before rendering it on the public-facing form, allowing high-privilege users to store JavaScript that executes in the browser of any visitor who views the form. This vulnerability affects high-privilege users such as administrators, who do not hold the unfiltered_html capability on multisite. The v [truncated]