WordPress plugin
Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 28 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical3
- High10
- Medium14
- Low1
All Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder vulnerabilities
- Medium6.5Authenticated (Administrator+) SQL Injection via 'filterText' Parameter
≤3.2.0Update to 3.2.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
<3.1.4Update to 3.1.4
- Medium5.3Missing Authorization to Unauthenticated Unauthorized Form Submission
<3.1.2Update to 3.1.2
- High7.2Unauthenticated Stored Cross-Site Scripting
≤3.1.0Update to 3.2.0
- High7.1Authenticated (Subscriber+) Arbitrary File Deletion via '_old' Parameter
≤3.1.1Update to 3.1.2
- Medium5.3Missing Authorization
≤3.0.0Update to 3.1.0
- High7.5Unauthenticated Arbitrary File Read
≤3.0.0Update to 3.1.0
- Medium4.9Authenticated (Administrator+) SQL Injection
≤2.21.10Update to 2.21.11
- Medium6.5Missing Authorization to Unauthenticated Workflow Replay
≤2.21.6Update to 2.21.7
- Critical9.8Bit Form <= 2.20.3 - Unauthenticated Arbitrary File Upload
≤2.20.3Update to 2.20.4
- Medium5.3Unauthenticated Sensitive Information Exposure
≤2.17.5Update to 2.17.6
- Medium4.9Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
≤2.18.3Update to 2.18.4
- High7.2Open Redirect
≤2.18.0Update to 2.18.1
- Low3.8Authenticated (Administrator+) Server-Side Request Forgery
≤2.17.4Update to 2.17.5
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Form Submission Disclosure
≤2.17.3Update to 2.17.4
- Medium4.9Authenticated (Administrator+) Improper Input Validation via iconUpload Function to Arbitrary File Read
≤2.15.2Update to 2.15.3
- Medium4.9Authenticated (Administrator+) SQL Injection
≤2.13.11Update to 2.13.12
- High7.2Authenticated (Administrator+) Arbitrary File Upload
≤2.13.10Update to 2.13.11
- High7.2Unauthenticated Stored Cross-Site Scripting
≤2.13.10Update to 2.13.11
- High7.22.13.9 - Authenticated (Administrator+) SQL Injection via getLogHistory Function
2.0 – 2.13.9Update to 2.13.10
- Medium5.52.13.9 - Authenticated (Administrator+) Arbitrary JavaScript File Uploads
2.0 – 2.13.9Update to 2.13.10
- Critical9.02.13.9 - Authenticated (Administrator+) Arbitrary File Read And Deletion
2.0 – 2.13.9Update to 2.13.10
- High7.22.13.9 - Authenticated (Administrator+) SQL Injection
2.0 – 2.13.9Update to 2.13.10
- High8.72.13.4 - Authenticater (Administrator+) Arbitrary File Deletion
2.0 – 2.13.4Update to 2.13.5
- High7.2Authenticated (Administrator+) Arbitrary File Upload
≤2.13.3Update to 2.13.4
- Medium5.3Unauthenticated Insecure Direct Object Reference to Form Submission Alteration
≤2.10.1Update to 2.10.2
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤2.1.0Update to 2.2.0
- Critical9.8Unauthenticated Arbitrary File Upload to Remote Code Execution
≤1.8.1Update to 1.9
Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder: common questions
Does Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder have known vulnerabilities?
Yes. VulnCrest Radar lists 28 known vulnerabilities in Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder: 3 critical, 10 high, 14 medium, 1 low. None are known to affect version null.
How do I check which version of Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder vulnerability?
CVE-2026-16810, published Aug 13, 2026: Bit Form <= 3.2.0 - Authenticated (Administrator+) SQL Injection via 'filterText' Parameter. Severity: Medium (CVSS 6.5).
Is any Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder vulnerability listed in CISA KEV?
No. None of the known Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder vulnerabilities is currently listed in the CISA KEV catalog.