Threats tagged 'ghsa-5prm-g28p-frm9'

Bit Form WordPress plugin versions before 3.2.0 contain a stored cross-site scripting (XSS) vulnerability. This occurs because the plugin does not sanitize uploaded signature images, allowing unauthenticated attackers to upload crafted SVG files with embedded JavaScript. When these SVG files are viewed, the malicious script executes, potentially compromising confidentiality, integrity, and availability.