CVE-2026-8891

Vulnerability

The BitForm plugin for WordPress versions up to and including 1.1.0 is vulnerable to Stored Cross-Site Scripting (XSS) in the Shortcode::shortcode() function. User-supplied 'width' and 'height' attributes of the 'bitform' shortcode are not properly sanitized and are directly interpolated into the 'style' attribute of an `` element. This allows an attacker to inject arbitrary HTML and JavaScript code. [1]

Exploitation

An authenticated attacker with contributor-level access or higher can create or edit a post or page with the 'bitform' shortcode, providing malicious content in the 'width' or 'height' attribute. The injected script will be stored and executed when any user views the affected page. No additional user interaction is required during the exploit.

Impact

Successful exploitation leads to Stored XSS, enabling the attacker to perform actions such as stealing cookies, redirecting users, defacing pages, or executing arbitrary JavaScript in the context of the victim's browser. The attacker does not gain elevated privileges beyond the initial role, but the stored script can affect site administrators if they visit the compromised page.

Mitigation

As of the publication date of this CVE (2026-05-27), no fixed version has been released. Users of BitForm versions up to 1.1.0 should remove or disable the plugin until a security update is available. Alternatively, restrict contributor-level access and avoid using the vulnerable shortcode attributes.