Bit Form Plugin Stores Malicious SVG Without Sanitization

The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing unauthenticated attackers to upload a crafted SVG file containing JavaScript that executes when the file is viewed, leading to Stored Cross-Site Scripting.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Bit Form is a popular WordPress form builder plugin used by thousands of websites to create custom contact forms and data collection workflows. CVE-2026-16573 exposes a critical vulnerability in how the plugin handles signature image uploads—specifically, it fails to sanitize SVG files before storage. This allows unauthenticated attackers to upload a crafted SVG containing embedded JavaScript that executes in the browsers of anyone viewing the stored signature. The vulnerability is particularly dangerous because signature fields are often visible to multiple users (form administrators, customers reviewing submissions), amplifying the blast radius. Any WordPress site running Bit Form before version 3.2.0 is vulnerable, and the lack of authentication requirements means attackers can exploit this without credentials.

Casky's 322 matching skills, powered by Claude's extended reasoning capabilities, map this vulnerability across two critical MITRE ATT&CK tactics: TA0001 (Reconnaissance) and TA0043 (Reconnaissance via public sources). Practitioners using Casky would detect attack patterns including: malicious file upload attempts targeting the signature upload endpoint (T1190 - Exploit Public-Facing Application), identification of SVG payloads containing script tags or event handlers, and indicators of stored XSS execution when reviewing form submission logs. The platform would flag the absence of Content-Type validation and MIME-type checking in upload handlers, correlate the attack with CWE-79 weakness patterns, and surface that unauthenticated file uploads represent a direct path to persistent code execution. Security teams would see findings highlighting the gap between file extension validation (if present) and actual file content inspection, enabling rapid prioritization of patching efforts.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-16573.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-16573

Casky has 322 skills that investigate the attack patterns behind CVE-2026-16573. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn