CVE-2025-15669 is a stored Cross-Site Scripting vulnerability in the Bit Form WordPress plugin before version 3.1.4. A user with permission to manage the plugin can store script content in a conversational form setting. The content can run in a visitor’s browser and may lead to unauthorized actions or compromise of an administrator account. Version 2.19.1 was used during testing.
| CVE | CVE-2025-15669 |
| Plugin Version | Bit Form < 3.1.4, fixed in 3.1.4 |
| All Time | 489 458 |
| Active installations | 10 000+ |
| Publicly Published | July 17, 2026 |
| Last Updated | July 17, 2026 |
| Researcher | Dmitrii Ignatyev |
| CWE | CWE-79 Cross-Site Scripting |
| PoC | Yes |
| Exploit | No |
| Reference | https://www.cve.org/CVERecord?id=CVE-2025-15669 https://wpscan.com/vulnerability/69800fa9-4fbd-489c-8759-96df745d77d6/ |
| Plugin Security Certification by CleanTalk |  |
| Logo of the plugin |  |
PSC by CleantalkJoin the community of developers who prioritize security. Highlight your plugin in the WordPress catalog.
Timeline
| Not recorded | The date of the initial discovery was not provided. |
| May 27, 2025 | The vulnerability report was sent to the relevant parties. |
| May 29, 2025 | The developer’s changelog lists the release of version 2.19.1. Its relationship to the earlier reporting date needs verification. |
| July 17, 2026 | WPScan publicly published the advisory for CVE-2025-15669. |
| August 1, 2026 | The CVE-2025-15669 record was published in the CVE Program registry. |
Discovery of the Vulnerability
During testing of Bit Form 2.19.1, Dmitrii Ignatyev identified stored XSS in a conversational form display setting. The affected value was retained by the plugin and rendered without sufficient sanitization or output escaping.
The reported test used an editor account. WPScan describes the prerequisite as administrator access or a role explicitly granted the plugin’s form management capability. Whether an editor can reach the affected setting depends on the permissions assigned on the site.
Understanding of Stored Cross-Site Scripting attacks
Stored XSS occurs when a website saves content that is later interpreted as executable code in another user’s browser. The code runs in the context of the affected site and can act with the permissions of the person viewing the page.
In this case, visitors to an affected conversational form could encounter the stored content. A privileged visitor may face a greater risk because unauthorized actions can be performed under that account.
Exploiting the Stored Cross-Site Scripting Vulnerability
The researcher confirmed the issue in a controlled test on an affected version. The proof of concept demonstrated script execution after the unsafe setting was stored.
POC:
Controlled testing confirmed stored script execution in an affected Bit Form setting.____
The test was conducted with the unfiltered_html capability disallowed so that script execution would not be confused with the normal behavior of users who can publish unrestricted HTML.
Recommendations for Improved Security
Update Bit Form to version 3.1.4 or later. Review the permissions assigned to accounts that can manage forms and remove access that is no longer required.
Plugin developers should sanitize submitted display values and escape output for the context in which it is rendered. Site owners should review existing conversational form settings for unexpected content and investigate suspicious administrative activity.
Keeping plugins updated and reviewing who can manage form settings helps protect visitors and site administrators.
#WordPressSecurity #StoredXSS #WebsiteSafety #StayProtected
Use CleanTalk solutions to improve the security of your website.
