{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102007",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T18:25:09.300892Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T18:25:28.431Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Bit integrations \u2013 Form Integration, Webhook, Spreadsheets, CRM, LMS \u0026 Email Automation",
          "vendor": "bitpressadmin",
          "versions": [
            {
              "lessThanOrEqual": "2.10.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Bit integrations \u2013 Form Integration, Webhook, Spreadsheets, CRM, LMS \u0026 Email Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027field mapped to notification_content (attacker-chosen key, e.g. payload_text)\u0027 parameter in all versions up to, and including, 2.10.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires a site administrator to have preconfigured a Bit Integrations flow that binds the public Bit Assist webhook to a BuddyBoss \"Send Notification\" action with a form field mapped to notification_content, and the attacker to know the flow\u0027s UUID callback URL."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T07:46:23.568Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ee912e24-7ed5-459c-a8ce-2bcb265bdeb0?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.10.6/backend/Actions/BuddyBoss/BuddyBossController.php#L129"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.10.6/backend/Actions/BuddyBoss/RecordApiHelper.php#L367"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.10.6/backend/Actions/BuddyBoss/RecordApiHelper.php#L491"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.10.6/backend/Triggers/Webhook/WebhookController.php#L80"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.10.6/backend/Routes/api.php#L17"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3730118/bit-integrations/trunk/backend/Actions/BuddyBoss/RecordApiHelper.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-28T17:36:09.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-12T19:07:13.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Bit integrations \u003c= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via \u0027notification_content\u0027 Field via Public Bit Assist Webhook Callback"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-102007",
    "datePublished": "2026-10-13T07:46:23.568Z",
    "dateReserved": "2026-09-28T17:21:04.334Z",
    "dateUpdated": "2026-10-14T18:25:28.431Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-102007\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-14T18:25:09.300892Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-14T18:25:23.752Z\"}}], \"cna\": {\"title\": \"Bit integrations \u003c= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via \u0027notification_content\u0027 Field via Public Bit Assist Webhook Callback\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Wordfence PRISM\"}], \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.2, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\"}}], \"affected\": [{\"vendor\": \"bitpressadmin\", \"product\": \"Bit integrations \\u2013 Form Integration, Webhook, Spreadsheets, CRM, LMS \u0026 Email Automation\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"2.10.6\"}], \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-09-28T17:36:09.000Z\", \"value\": \"Vendor Notified\"}, {\"lang\": \"en\", \"time\": \"2026-10-12T19:07:13.000Z\", \"value\": \"Disclosed\"}], \"references\": [{\"url\": \"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee912e24-7ed5-459c-a8ce-2bcb265bdeb0?source=cve\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.10.6/backend/Actions/BuddyBoss/BuddyBossController.php#L129\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.10.6/backend/Actions/BuddyBoss/RecordApiHelper.php#L367\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.10.6/backend/Actions/BuddyBoss/RecordApiHelper.php#L491\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.10.6/backend/Triggers/Webhook/WebhookController.php#L80\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.10.6/backend/Routes/api.php#L17\"}, {\"url\": \"https://plugins.trac.wordpress.org/changeset/3730118/bit-integrations/trunk/backend/Actions/BuddyBoss/RecordApiHelper.php\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The Bit integrations \\u2013 Form Integration, Webhook, Spreadsheets, CRM, LMS \u0026 Email Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027field mapped to notification_content (attacker-chosen key, e.g. payload_text)\u0027 parameter in all versions up to, and including, 2.10.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires a site administrator to have preconfigured a Bit Integrations flow that binds the public Bit Assist webhook to a BuddyBoss \\\"Send Notification\\\" action with a form field mapped to notification_content, and the attacker to know the flow\u0027s UUID callback URL.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"shortName\": \"Wordfence\", \"dateUpdated\": \"2026-10-13T07:46:23.568Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-102007\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-14T18:25:28.431Z\", \"dateReserved\": \"2026-09-28T17:21:04.334Z\", \"assignerOrgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"datePublished\": \"2026-10-13T07:46:23.568Z\", \"assignerShortName\": \"Wordfence\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}