Stored Cross-Site Scripting Vulnerability in Bit Integrations for WordPress
CVE-2026-102007

7.2HIGH

Key Information:

Vendor

WordPress
Status
Bit Integrations – Form Integration, Webhook, Spreadsheets, Crm, Lms & Email Automation
Vendor
CVE Published:
13 October 2026

What is CVE-2026-102007?

The Bit Integrations plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability due to inadequate input sanitization and output escaping. This flaw allows unauthenticated attackers to inject arbitrary scripts through the 'notification_content' parameter. If a site administrator has previously set up a Bit Integrations flow linking the public Bit Assist webhook to BuddyBoss's 'Send Notification' action, attackers could exploit this vulnerability through knowledge of the flow's UUID callback URL. As a result, malicious scripts can be executed on pages viewed by users, posing significant risks to website security.

Affected Version(s)

Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation 0 <= 2.10.6

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/bit-integratio...
https://plugins.trac.wordpress.org/browser/bit-integratio...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wordfence PRISM
.