CVE-2026-96227: CWE-79 Cross-Site Scripting (XSS) in Piotnet Forms
Description
The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be stored, allowing unauthenticated attackers to store a file that executes arbitrary JavaScript in the site's origin when it is opened (Stored XSS).
CVSS v3.1
Score 8.8high
Affected software
Piotnet Forms
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Piotnet Forms WordPress plugin through version 1.0.30 contains a stored XSS vulnerability due to lack of authentication and validation on form-submission file uploads. This flaw permits unauthenticated attackers to upload files that can execute arbitrary JavaScript when accessed, potentially leading to script execution within the site's origin.
Potential Impact
An attacker can exploit this vulnerability to execute arbitrary JavaScript in the context of the vulnerable website, which may lead to session hijacking, defacement, or other malicious actions performed on behalf of users visiting the site. The vulnerability affects unauthenticated attackers, increasing its risk.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload capabilities and validate file types on the server side to prevent browser-renderable files from being stored. Monitor vendor channels for updates and apply patches promptly once released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-22T18:57:53.912Z
- State
- PUBLISHED
Threat ID: 6acb2de92cdf04f656b78e6c
Added to database: 10/11/2026, 06:34:17 UTC
Last enriched: 10/11/2026, 06:48:19 UTC
Last updated: 10/11/2026, 21:33:27 UTC
Views: 20
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.