Plugin icon

Bit Form – Custom Contact Form, Multi Step, Conversational Form & Payment Form builder

bit-form
Plugin closed

Vulnerabilities:

21

Last Updated:

February 3, 2026

Active Installs:

10000

Published
Title
Fixed in
CVSS
Published
2026-01-28
Title
Bit Form < 2.21.11 - Authenticated (Administrator+) SQL Injection
Fixed in
Fixed in 2.21.11
CVSS
4.9 (medium)
Published
2026-01-06
Title
Bit Form – Contact Form Plugin < 2.21.7 - Missing Authorization to Unauthenticated Workflow Replay
Fixed in
Fixed in 2.21.7
CVSS
6.5 (medium)
Published
2025-08-14
Title
Contact Form by Bit Form - Bit Form < 2.20.4 - Unauthenticated Arbitrary File Upload
Fixed in
Fixed in 2.20.4
CVSS
9.8 (critical)
Published
2025-07-01
Title
Contact Form by Bit Form < 2.17.6 - Unauthenticated Sensitive Information Exposure
Fixed in
Fixed in 2.17.6
CVSS
5.3 (medium)
Published
2025-04-24
Title
Contact Form by Bit Form < 2.18.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Fixed in
Fixed in 2.18.4
CVSS
4.9 (medium)
Published
2025-03-27
Title
Bit Form – Contact Form Plugin < 2.18.1 - Open Redirect
Fixed in
Fixed in 2.18.1
CVSS
7.2 (high)
Published
2025-01-24
Title
Contact Form by Bit Form < 2.17.5 - Authenticated (Administrator+) Server-Side Request Forgery
Fixed in
Fixed in 2.17.5
CVSS
3.8 (low)
Published
2024-12-24
Title
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder < 2.17.4 - Missing Authorization to Authenticated (Subscriber+) Form Submission Disclosure
Fixed in
Fixed in 2.17.4
CVSS
4.3 (medium)
Published
2024-10-10
Title
Contact Form by Bit Form< 2.15.3 - Admin+ Arbitrary File Read
Fixed in
Fixed in 2.15.3
CVSS
2.7 (low)
Published
2024-09-26
Title
Bit Form – Contact Form Plugin < 2.13.12 - Authenticated (Administrator+) SQL Injection
Fixed in
Fixed in 2.13.12
CVSS
4.9 (medium)
Published
2024-09-25
Title
Bit Form – Contact Form Plugin < 2.13.11 - Authenticated (Administrator+) Arbitrary File Upload
Fixed in
Fixed in 2.13.11
CVSS
7.2 (high)
Published
2024-09-24
Title
Bit Form – Contact Form Plugin < 2.13.11 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 2.13.11
CVSS
7.2 (high)
Published
2024-08-19
Title
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) SQL Injection via getLogHistory Function
Fixed in
Fixed in 2.13.10
CVSS
7.2 (high)
Published
2024-08-19
Title
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) Arbitrary JavaScript File Uploads
Fixed in
Fixed in 2.13.10
CVSS
5.5 (medium)
Published
2024-08-19
Title
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) Arbitrary File Read And Deletion
Fixed in
Fixed in 2.13.10
CVSS
9 (critical)
Published
2024-08-19
Title
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) SQL Injection
Fixed in
Fixed in 2.13.10
CVSS
7.2 (high)
Published
2024-08-19
Title
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.4 - Authenticater (Administrator+) Arbitrary File Deletion
Fixed in
Fixed in 2.13.5
CVSS
8.7 (high)
Published
2024-07-08
Title
Bit Form < 2.13.4 - Authenticated (Administrator+) Arbitrary File Upload
Fixed in
Fixed in 2.13.4
CVSS
7.2 (high)
Published
2024-03-13
Title
Contact Form Builder Plugin: Multi Step Contact Form, Payment Form, Custom Contact Form Plugin by Bit Form < 2.10.2 - Unauthenticated Insecure Direct Object Reference to Form Submission Alteration
Fixed in
Fixed in 2.10.2
CVSS
5.3 (medium)
Published
2023-07-24
Title
Contact Form Builder by Bit Form < 2.2.0 - Admin+ Stored XSS
Fixed in
Fixed in 2.2.0
CVSS
3.5 (low)
Published
2023-04-19
Title
Bit Form < 1.9 - RCE via Unauthenticated Arbitrary File Upload
Fixed in
Fixed in 1.9
CVSS
9.4 (critical)