CVE-2026-102007: Bit integrations <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via 'notification_content' Field via Public Bit Assist Webhook Callback
The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field mapped to notificationcontent (attacker-chosen key, e.g. payloadtext)' parameter in all versions up to, and including, 2.10.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires a site administrator to have preconfigured a Bit Integrations flow that binds the public Bit Assist webhook to a BuddyBoss "Send Notification" action with a form field mapped to notificationcontent, and the attacker to know the flow's UUID callback URL.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to exploitation?
Only sites with a Bit Integrations flow already configured to bind a public Bit Assist webhook callback to a BuddyBoss "Send Notification" action, with a form field mapped to notification_content, are described as exposed. Installations without that specific flow configuration are not identified as exploitable by the provided information.
What does an attacker need to exploit this issue?
The attacker does not need authentication or user interaction, but must know the UUID callback URL for the configured flow. They can then submit script content through the field mapped to notification_content, using an attacker-chosen field key such as payload_text.
When does the injected script execute?
The script is stored and executes when a user accesses an injected page. The provided information does not specify which user roles can access those pages.
How can administrators determine whether their configuration is affected?
Review Bit Integrations flows for public Bit Assist webhook callbacks that invoke BuddyBoss "Send Notification." A flow is in scope when one of its form fields is mapped to notification_content; its UUID callback URL should be treated as sensitive in this context.