CVE-2026-96227
Received Received - Intake

Stored XSS in Piotnet Forms WordPress Plugin

Publication date: 2026-10-11

Last updated on: 2026-10-11

Assigner: WPScan

Description
The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be stored, allowing unauthenticated attackers to store a file that executes arbitrary JavaScript in the site's origin when it is opened (Stored XSS).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-11
Last Modified
2026-10-11
Generated
2026-10-11
AI Q&A
2026-10-11
EPSS Evaluated
N/A
NVD
CVE-2026-96227
EUVD
EUVD-2026-96795

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Piotnet Forms 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Piotnet Forms WordPress plugin versions 1.0.30 and below. It allows unauthenticated attackers to upload files that can execute arbitrary JavaScript when accessed, due to missing authentication or validation for file-upload requests. This results in a stored cross-site scripting (XSS) vulnerability.

Detection Guidance

Check if the Piotnet Forms plugin version 1.0.30 or below is installed on your WordPress site. Look for unexpected file uploads in directories typically used by the plugin. Monitor for unusual JavaScript execution in browser-renderable files.

Impact Analysis

An attacker could exploit this to upload malicious files that run JavaScript in your site's context. This could lead to unauthorized actions, data theft, or defacement of your WordPress site without requiring user interaction.

Compliance Impact

This vulnerability could lead to unauthorized data access or manipulation, potentially violating GDPR by exposing user data without consent or HIPAA by compromising protected health information if stored in forms.

Mitigation Strategies

Immediately update the Piotnet Forms plugin to the latest version if an update is available. If no update exists, consider disabling or removing the plugin until a patch is released. Implement strict file upload validation and authentication for all form submissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96227. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart