Stored Cross-Site Scripting in Bit Integrations Plugin for WordPress

Bit Integrations (versions 2.10.6 and earlier) contains a critical security flaw involving insufficient input sanitization and output escaping. An unauthenticated attacker can exploit this vulnerability to perform Stored Cross-Site Scripting (XSS) attacks. The flaw is located within the notification_content parameter, which is used when mapping form fields to BuddyBoss notifications. To trigger the vulnerability, an attacker must identify the publicly accessible webhook callback URL associated with a configured Bit Integrations flow. Once the malicious script is injected into the notification content, it executes within the browser of any user who accesses the compromised page, including administrative users, potentially leading to session hijacking, unauthorized administrative actions, or data exfiltration.

Impact

Successful exploitation of this vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the context of an administrator or user session. This can result in unauthorized modification of site content, capture of administrative session tokens, or the creation of new administrative users, effectively granting the attacker full control over the affected WordPress installation.

Recommendation

• Upgrade the Bit Integrations plugin to a version released after 2.10.6 immediately.
• Audit existing Bit Integrations flows to identify and remove any public-facing webhooks that are not explicitly required for business operations.
• Implement a strict Content Security Policy (CSP) to mitigate the impact of potential XSS vulnerabilities by restricting the sources from which scripts can be loaded and executed.
• Monitor webserver access logs for anomalous POST requests directed at plugin webhook endpoints containing suspicious characters or script tags in payload parameters.