The Bit Form WordPress plugin versions prior to 3.1.4 contain a stored cross-site scripting vulnerability (CWE-79). The flaw arises from insufficient sanitization of a conversational-form display setting, which is rendered on the public form. High-privilege users, including administrators lacking unfiltered_html capability in multisite environments, can exploit this to store malicious JavaScript. When other users visit the affected form, the injected script executes in their browsers, potentially leading to information disclosure or session manipulation. The CVSS 3.1 base score is 4.8 (medium severity) with vector AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, high privileges required, user interaction required, scope changed, and limited confidentiality and integrity impact without availability impact.

Successful exploitation allows high-privilege users to inject JavaScript that executes in the browsers of visitors to the affected form. This can lead to limited confidentiality and integrity impacts, such as theft of sensitive information or manipulation of user interactions on the form. There is no impact on availability. The vulnerability affects multisite WordPress environments where administrators do not have the unfiltered_html capability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's announcements for updates. Until a fix is available, restrict high-privilege user access to trusted individuals and consider disabling or limiting use of the affected conversational-form display settings to prevent injection of malicious scripts.