CVE-2026-16573

—

CVSS 3.1

7.5 high

EPSS

<1%p19

Published

Aug 5, 2026 (Aug 5, 2026)

Modified

Aug 26, 2026

Description

The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing unauthenticated attackers to upload a crafted SVG file containing JavaScript that executes when the file is viewed, leading to Stored Cross-Site Scripting.

Ecosystems: WordPress
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.