CVE-2026-102007: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in bitpressadmin Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation

CVE-2026-102007 describes a stored cross-site scripting vulnerability in the Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation WordPress plugin. The vulnerability exists in all versions up to and including 2.10.6 due to insufficient sanitization and escaping of user input in the parameter mapped to notification_content. An attacker can inject arbitrary web scripts that execute in the context of users accessing the injected pages. Exploitation requires that a site administrator has preconfigured a Bit Integrations flow binding the public Bit Assist webhook to a BuddyBoss 'Send Notification' action with a form field mapped to notification_content, and that the attacker knows the flow's UUID callback URL.

Successful exploitation allows an unauthenticated attacker to perform stored cross-site scripting attacks, leading to the execution of arbitrary scripts in the context of users visiting the affected pages. This can result in limited confidentiality and integrity impacts, such as theft of user session data or manipulation of displayed content. The vulnerability does not affect availability.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid configuring Bit Integrations flows that bind the public Bit Assist webhook to BuddyBoss 'Send Notification' actions with form fields mapped to notification_content, or restrict access to the flow's UUID callback URL to trusted parties only.