CVE-2026-102007Published

Bit integrations <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via 'notification_content' Field via Public Bit Assist Webhook Callback

Exact source revision recorded 23 Oct 2026 15:48:27 UTC. It does not establish the source's current position. Latest evidence.

Recorded JSON

Explicit identifiers and source references

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-102007 · Microsoft / collected KEV context

cve-program · CVE-2026-102007

https://www.wordfence.com/threat-intel/vulnerabilities/id/ee912e24-7ed5-459c-a8ce-2bcb265bdeb0?source=cve
https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.10.6/backend/Actions/BuddyBoss/BuddyBossController.php#L129
https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.10.6/backend/Actions/BuddyBoss/RecordApiHelper.php#L367
https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.10.6/backend/Actions/BuddyBoss/RecordApiHelper.php#L491
https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.10.6/backend/Triggers/Webhook/WebhookController.php#L80
https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.10.6/backend/Routes/api.php#L17
https://plugins.trac.wordpress.org/changeset/3730118/bit-integrations/trunk/backend/Actions/BuddyBoss/RecordApiHelper.php

Current operational correlations are not mixed into this historical source record. Open latest evidence to discover current connections.