Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation Plugin Vulnerability (CVE-2026-102007)

Security Alert Summary

The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to a stored cross-site scripting (XSS) flaw. Insufficient input sanitization and output escaping in a parameter mapped to notification_content can allow an unauthenticated attacker to inject JavaScript that will run when a user views an affected page. Successful exploitation requires a site administrator to have preconfigured a Bit Integrations flow that binds a public Bit Assist webhook to a BuddyBoss “Send Notification” action with a form field mapped to notification_content, and the attacker to know the flow’s UUID callback URL.

CVE Details

• CVE ID: CVE-2026-102007
• Affected component: Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress
• Affected versions: All versions up to and including 2.10.6
• Published: October 13, 2026 at 08:16:57 AM UTC
• Last modified: October 13, 2026 at 01:29:12 PM UTC
• CVSS v3.1: Base Score 7.2 – HIGH; Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
• Authentication / Privileges / User interaction: No authentication required; Privileges required: None; User interaction: None
• Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
• Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation)

Technical Details

This is a stored cross-site scripting (XSS) vulnerability caused by insufficient input sanitization and output escaping for an attacker-controlled parameter that is mapped to notification_content. The plugin allows a Bit Assist webhook to feed data into a BuddyBoss “Send Notification” action. If a site administrator has configured a flow that binds a public Bit Assist webhook to that action and maps a form field to notification_content, an attacker who knows the flow’s UUID callback URL can submit a payload key (for example, an attacker-chosen key like payload_text) containing script content.

The injected script is stored and will execute whenever a user accesses the page or notification that renders the stored notification_content without proper escaping. The vulnerability exists because user-supplied content can reach output locations rendered in users’ browsers without adequate neutralization.

Exploitation is constrained by the requirement that a vulnerable flow must already be configured and publicly reachable via its UUID callback URL. The immediate impact is execution of attacker-supplied script in the context of an affected user’s browser; this does not by itself imply full site compromise, but it can enable actions available to the browser context where the script runs.

How This Could Impact Your Website

Consider a site with multiple roles: a site owner or admin who configures Bit Integrations flows, internal staff who use the site and receive notifications, and external contractors or contributors who access notification pages. If a vulnerable flow is publicly reachable and an attacker submits a crafted payload to the webhook callback URL, the stored script could execute when staff or contributors view the affected notification or page.

Practical consequences include exposure of internal user-visible data such as displayed email addresses, session-based actions executed on behalf of the viewing user in the browser context, and increased risk of targeted phishing or social engineering that leverages information exposed via the injected script. The impact aligns with the CVSS ratings: primarily low confidentiality and integrity impacts rather than availability loss.

If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.

Recommended Actions

• Update the affected plugin as soon as a patched version is available.
• Review and reduce unnecessary user roles and capabilities, especially contributor-level or other roles that can be recipients of notifications.
• Enforce strong passwords and enable two-factor authentication for editors and administrators.
• Remove unused or unmaintained plugins and disable public webhook endpoints that are not required.
• Monitor site activity and logs for unusual webhook requests, unexpected content submissions, and abnormal user activity.

If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.

References

• https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.10.6/backend/Actions/BuddyBoss/BuddyBossController.php#L129
• https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.10.6/backend/Actions/BuddyBoss/RecordApiHelper.php#L367
• https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.10.6/backend/Actions/BuddyBoss/RecordApiHelper.php#L491
• https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.10.6/backend/Routes/api.php#L17
• https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.10.6/backend/Triggers/Webhook/WebhookController.php#L80
• https://plugins.trac.wordpress.org/changeset/3730118/bit-integrations/trunk/backend/Actions/BuddyBoss/RecordApiHelper.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/ee912e24-7ed5-459c-a8ce-2bcb265bdeb0?source=cve