CVE-2026-16573 is a stored cross-site scripting vulnerability in the Bit Form WordPress plugin prior to version 3.2.0. The flaw arises from improper sanitization of uploaded signature images, specifically SVG files, which can contain JavaScript code. An unauthenticated attacker can exploit this by uploading a malicious SVG file that executes JavaScript when viewed, leading to stored XSS. This vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity, with network attack vector, high attack complexity, no privileges required, and requiring user interaction.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of users viewing the malicious SVG image. This can lead to theft of sensitive information, session hijacking, or other actions impacting confidentiality, integrity, and availability of the affected system or user data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or monitor uploads of SVG files and consider disabling signature image uploads if feasible. Implement additional input validation or sanitization on uploaded files as a temporary mitigation.