The Bit Form WordPress plugin versions prior to 3.1.4 contain a stored cross-site scripting vulnerability (CWE-79) due to improper sanitization of a conversational-form display setting. High-privilege users can inject malicious JavaScript that executes in the context of any visitor viewing the form, potentially leading to client-side code execution. The vulnerability is documented as CVE-2025-15669. No CVSS score or official remediation level is provided, and no patch links are available in the provided data.

An attacker with high privileges (e.g., administrator without unfiltered_html capability on multisite) can inject JavaScript that executes in the browsers of any visitor viewing the form. This can lead to typical XSS impacts such as session hijacking, defacement, or redirection to malicious sites. Since the injection requires high privileges, the risk is limited to environments where such users exist and can exploit this flaw.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, administrators should monitor for updates from the Bit Form plugin vendor and apply any released patches promptly. Until a fix is available, restrict high-privilege user access and avoid using the vulnerable display setting if possible.