Bit integrations <= 2.10.6 Unauthenticated Stored XSS via Webhook (CVE-2026-102007)

Vulnerability Overview Vulnerability Name: Bit integrations <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via 'notification_content' Field via Public Bit Assist Webhook Callback CVE ID: CVE-2026-102007 CVSS Score: 7.2 (High) Publication Date: October 12, 2026 Last Updated: October 13, 2026 Researchers: Wordfence PRISM - Wordfence Impact Scope Affected Versions: Bit integrations <= 2.10.6 Vulnerability Type: Stored Cross-Site Scripting (Stored XSS) Vulnerability Description: The field in the Bit integrations plugin contains a stored cross-site scripting vulnerability. Attackers can execute arbitrary JavaScript code when users visit affected pages by crafting malicious payloads. Remediation Fixed Version: Upgrade to Bit integrations 2.10.7 or higher Remediation Measures: Update the plugin to the latest version to ensure all known vulnerabilities are patched. Additional Information Related Vulnerabilities: - Bit integrations <= 2.10.6 - Unauthenticated Privilege Escalation via Identity-Confused Log Re-execution to Account Takeover via Log Re-execution of Anonymous-Captured Field Data (CVE-2026-104749) - Bit integrations <= 2.9.0 - Unauthenticated Arbitrary File Read via Optional CFT File Field (CVE-2026-15006) - Bit integrations <= 2.8.7 - Unauthenticated Server-Side Request Forgery via Form Field Upload Mapping (CVE-2026-11989) - Bit integrations <= 2.4.10 - Open Redirect (CVE-2025-30884) Reference Links plugins.trac.wordpress.org Sharing Options Facebook Twitter LinkedIn Email Disclaimer This record contains copyrighted material. Copyright: 2012-2026 Defiant Inc. MITRE Corporation Copyright: 1999-2026 Contact Information For any questions or further information, please contact: wfi-support@wordfence.com Business Hours Working Hours: 9am-8pm ET, 6am-5pm PT, 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 24/7/365 Support with a 1-hour response time Terms of Service Terms of Service Privacy Policy and Collection Notice Do Not Sell or Share My Personal Information Products and Support Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central News and Updates Blog In The News Vulnerability Advisories About Wordfence About Wordfence Affiliate Program Employment Contact Security CVE Request Form Subscribe for Updates Subscribe to news and updates to receive the latest information from our team of experienced security professionals. Copyright Information © 2012-2026 Defiant Inc. All Rights Reserved Additional View free personal and commercial API access provided by Wordfence Intelligence to the latest WordPress vulnerability database. Install Wordfence to receive immediate notifications of new vulnerabilities affecting your site. The Wordfence Intelligence WordPress Vulnerability Database is fully free to access and query via API. Please see the documentation for details on how to access and consume vulnerability data. Summary This page primarily details a Stored Cross-Site Scripting vulnerability in the Bit integrations plugin, affecting versions <= 2.10.6, and provides remediation steps and reference links. Additionally, the page lists other related vulnerabilities and information about Wordfence.

Goal Reached Thanks to every supporter — we hit 100%!

Bit integrations <= 2.10.6 Unauthenticated Stored XSS via Webhook (CVE-2026-102007)