Bit Form < 3.1.4 – Admin+ Stored XSS via Conversational Form Progress Label | CVE 2025-15669

Description

The plugin does not sanitise one of its conversational-form display settings before rendering it on the public-facing form, allowing high-privilege users (such as administrators, who do not hold the unfiltered_html capability on multisite) to store JavaScript that executes in the browser of any visitor who views the form.

Proof of Concept

Prerequisite: an attacker account with administrator access (or a role explicitly granted the plugin's custom manage_bitform capability).

1. Bit Form -> create a form -> enable "Conversational Form".
2. Settings -> Navigation tab -> set "Progress Label" to:
      <img src=x onerror=alert(document.domain)>
   Ensure "Show Progress Label" is enabled, then Save.
3. As ANY unauthenticated visitor, open:
      https://victim.example/?bit-conversational-form=<FORM_ID>
   The stored value renders raw inside the progress-label span and the script executes in the visitor's browser.