CVE-2026-39070

MediumCVSS 4.8

Published: 28/08/2026(UTC)Updated: 01/09/2026(UTC)Translated: 29/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

7th percentile - higher than 7% of all known CVEs

Summary

The WordPress plugin (Bit Assist) before version 1.7.2 is affected by Stored Cross-Site Scripting in the Call-To-Action feature. An authenticated attacker with the privileged role (admin) can exploit this to redirect users to a malicious site or control the account.

Risk Assessment

The attack can lead to admin account takeover, enabling full control over the website and potential infection of other users.

Recommendation

Update the Bit Assist plugin to version 1.7.2 or later as soon as possible and regularly audit administrator privileges.

Other vulnerabilities in Bit Assist

CVE-2025-68596Medium
The Bit Assist plugin (versions up to and including 1.5.11) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects Bit Assist from n/a through 1.5.11.

Original NVD description (English source)

WordPress plugin (Bit Assist) before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature. An authenticated attacker with the privileged role (admin) can exploit this to redirect user to malicious site or control the account.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS