CVE-2024-47301: Bit Form Stored XSS Vulnerability

CVE-2024-47301 Overview

CVE-2024-47301 is a stored Cross-Site Scripting (XSS) vulnerability in the Bit Apps Bit Form plugin for WordPress. The flaw affects all versions of bit-form up to and including 2.13.10. Improper neutralization of user-supplied input during web page generation allows attackers to inject persistent JavaScript payloads. Stored payloads execute in the browsers of users who view the affected pages. The issue is tracked under CWE-79 and carries a network attack vector requiring user interaction. According to EPSS data from 2026-06-23, the vulnerability has a 0.292% exploit probability score at the 20.69 percentile.

Critical Impact
Authenticated or unauthenticated attackers (depending on form configuration) can store malicious scripts that execute in administrators' or visitors' sessions, enabling credential theft, session hijacking, and arbitrary actions on behalf of victims.

Affected Products

Bit Apps Bit Form plugin for WordPress
All versions from initial release through 2.13.10
WordPress sites embedding Bit Form forms on public or administrative pages

Discovery Timeline

2024-10-06 - CVE-2024-47301 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-47301

Vulnerability Analysis

The vulnerability is a stored XSS flaw classified under [CWE-79]. Bit Form fails to neutralize attacker-controlled input before rendering it within generated HTML output. Once injected, the malicious markup is persisted in the WordPress database and reflected back to any user who loads the affected form or administration view.

Exploitation requires user interaction, typically loading a page that renders the tainted form data. The scope is changed, meaning the injected script executes in a security context different from the vulnerable component. Confidentiality, integrity, and availability are each impacted at a low level, consistent with browser-side script execution.

Root Cause

The root cause is missing or inadequate output encoding and input sanitization in fields handled by the Bit Form plugin. User-controlled values flow into HTML rendering paths without contextual escaping. Standard WordPress sanitization helpers such as esc_html(), esc_attr(), or wp_kses() are not applied to all attacker-reachable fields prior to version 2.13.11.

Attack Vector

An attacker submits a form or modifies plugin-managed content to include a JavaScript payload within a vulnerable field. The plugin stores the payload verbatim. When a victim (often a site administrator reviewing form submissions) views the rendered page, the browser executes the injected script in the site's origin. This grants the attacker access to session cookies, authenticated requests, and the WordPress admin DOM.

For technical details, refer to the Patchstack Vulnerability Report.

Detection Methods for CVE-2024-47301

Indicators of Compromise

Unexpected <script>, <iframe>, or event-handler attributes (onerror=, onload=) stored in wp_postmeta or Bit Form database tables
Outbound requests from administrator browsers to attacker-controlled domains shortly after viewing form submissions
New or modified WordPress administrator accounts created without corresponding admin login events

Detection Strategies

Query the WordPress database for Bit Form entries containing HTML control characters or script-like substrings (javascript:, onerror, <svg)
Inspect web server logs for POST requests to Bit Form REST endpoints carrying encoded script payloads
Use a Content Security Policy (CSP) report-only header to surface inline script violations originating from form-rendering pages

Monitoring Recommendations

Monitor WordPress administrator sessions for anomalous AJAX requests to /wp-admin/admin-ajax.php or REST routes immediately after viewing form data
Alert on changes to user roles, options (siteurl, home), and active plugins that follow administrator interaction with form pages
Track plugin version inventories across managed WordPress sites and flag any instance running bit-form ≤ 2.13.10

How to Mitigate CVE-2024-47301

Immediate Actions Required

Update the Bit Form plugin to a release later than 2.13.10 on every WordPress site in scope
Audit existing form submissions and plugin-managed content for stored script payloads and purge malicious entries
Rotate WordPress administrator passwords and invalidate active sessions if exploitation is suspected

Patch Information

The vendor addresses the issue in releases after 2.13.10. Confirm the fixed version via the Patchstack Vulnerability Report and apply through the WordPress plugin updater or by replacing the plugin directory under wp-content/plugins/bit-form/.

Workarounds

Disable the Bit Form plugin until an updated version is deployed if patching cannot be performed immediately
Deploy a web application firewall (WAF) rule that blocks form submissions containing <script, javascript:, and common event-handler attributes
Enforce a strict Content Security Policy that disallows inline script execution on pages that render Bit Form output

bash

# Configuration example: update Bit Form via WP-CLI and verify version
wp plugin update bit-form --path=/var/www/html
wp plugin get bit-form --field=version --path=/var/www/html