CVE-2026-39070

Received Received - Intake

Stored XSS in Bit Assist WordPress Plugin

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: MITRE

Description

WordPress plugin (Bit Assist) before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature. An authenticated attacker with the privileged role (admin) can exploit this to redirect user to malicious site or control the account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-39070

EUVD

EUVD-2026-67902

Affected Vendors & Products

Vendor	Product	Version / Range
bit_assist	bit_assist	to 1.7.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) issue in the WordPress plugin Bit Assist before version 1.7.2. It affects the Call-To-Action feature and allows an authenticated attacker with admin privileges to inject malicious scripts. These scripts can then be stored on the site and executed when other users access the affected pages.

Impact Analysis

If you are an admin using Bit Assist before 1.7.2, an attacker could exploit this to redirect users to malicious websites or take control of their accounts. For regular users, this could lead to phishing attacks, session hijacking, or theft of sensitive data.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations using the vulnerable plugin may face compliance violations and potential legal consequences.

Mitigation Strategies

Update the Bit Assist plugin to version 1.7.2 or later to address the Stored Cross-Site Scripting vulnerability in the Call-To-Action feature.

Hi! I’m here to help you understand CVE-2026-39070. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70