WordPress plugin
Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 28 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical3
- High10
- Medium14
- Low1
All Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤3.1.0Update to 3.2.0 | CVE-2026-16573 | |
| High7.1 | Authenticated (Subscriber+) Arbitrary File Deletion via '_old' Parameter ≤3.1.1Update to 3.1.2 | CVE-2026-14372 | |
| High7.5 | Unauthenticated Arbitrary File Read ≤3.0.0Update to 3.1.0 | CVE-2026-13693 | |
| Critical9.8 | Bit Form <= 2.20.3 - Unauthenticated Arbitrary File Upload ≤2.20.3Update to 2.20.4 | CVE-2025-6679 | |
| High7.2 | Open Redirect ≤2.18.0Update to 2.18.1 | CVE-2025-30885 | |
| High7.2 | Authenticated (Administrator+) Arbitrary File Upload ≤2.13.10Update to 2.13.11 | CVE-2024-47319 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤2.13.10Update to 2.13.11 | CVE-2024-47301 | |
| High7.2 | 2.13.9 - Authenticated (Administrator+) SQL Injection via getLogHistory Function 2.0 – 2.13.9Update to 2.13.10 | CVE-2024-7702 | |
| Critical9.0 | 2.13.9 - Authenticated (Administrator+) Arbitrary File Read And Deletion 2.0 – 2.13.9Update to 2.13.10 | CVE-2024-7777 | |
| High7.2 | 2.13.9 - Authenticated (Administrator+) SQL Injection 2.0 – 2.13.9Update to 2.13.10 | CVE-2024-7780 | |
| High8.7 | 2.13.4 - Authenticater (Administrator+) Arbitrary File Deletion 2.0 – 2.13.4Update to 2.13.5 | CVE-2024-7782 | |
| High7.2 | Authenticated (Administrator+) Arbitrary File Upload ≤2.13.3Update to 2.13.4 | CVE-2024-6123 | |
| Critical9.8 | Unauthenticated Arbitrary File Upload to Remote Code Execution ≤1.8.1Update to 1.9 | CVE-2022-4774 |
- High7.2Unauthenticated Stored Cross-Site Scripting
≤3.1.0Update to 3.2.0
- High7.1Authenticated (Subscriber+) Arbitrary File Deletion via '_old' Parameter
≤3.1.1Update to 3.1.2
- High7.5Unauthenticated Arbitrary File Read
≤3.0.0Update to 3.1.0
- Critical9.8Bit Form <= 2.20.3 - Unauthenticated Arbitrary File Upload
≤2.20.3Update to 2.20.4
- High7.2Open Redirect
≤2.18.0Update to 2.18.1
- High7.2Authenticated (Administrator+) Arbitrary File Upload
≤2.13.10Update to 2.13.11
- High7.2Unauthenticated Stored Cross-Site Scripting
≤2.13.10Update to 2.13.11
- High7.22.13.9 - Authenticated (Administrator+) SQL Injection via getLogHistory Function
2.0 – 2.13.9Update to 2.13.10
- Critical9.02.13.9 - Authenticated (Administrator+) Arbitrary File Read And Deletion
2.0 – 2.13.9Update to 2.13.10
- High7.22.13.9 - Authenticated (Administrator+) SQL Injection
2.0 – 2.13.9Update to 2.13.10
- High8.72.13.4 - Authenticater (Administrator+) Arbitrary File Deletion
2.0 – 2.13.4Update to 2.13.5
- High7.2Authenticated (Administrator+) Arbitrary File Upload
≤2.13.3Update to 2.13.4
- Critical9.8Unauthenticated Arbitrary File Upload to Remote Code Execution
≤1.8.1Update to 1.9
Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder: common questions
Does Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder have known vulnerabilities?
Yes. VulnCrest Radar lists 28 known vulnerabilities in Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder: 3 critical, 10 high, 14 medium, 1 low. None are known to affect version null.
How do I check which version of Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder vulnerability?
CVE-2026-16810, published Aug 13, 2026: Bit Form <= 3.2.0 - Authenticated (Administrator+) SQL Injection via 'filterText' Parameter. Severity: Medium (CVSS 6.5).
Is any Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder vulnerability listed in CISA KEV?
No. None of the known Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder vulnerabilities is currently listed in the CISA KEV catalog.