CVE-2026-8891

Name of the Vulnerable Software and Affected Versions BitForm versions prior to 1.1.1

Description Stored Cross-Site Scripting occurs via the 'bitform' shortcode due to insufficient input sanitization and output escaping in the Shortcode::shortcode() function. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts through the width and height attributes, which are interpolated directly into the 'style' attribute of an element. These scripts execute when a user visits the affected page.

Recommendations Update BitForm to a version later than 1.1.0. As a temporary mitigation, restrict the ability of users with contributor-level access to edit pages or use the 'bitform' shortcode.