Piotnet Forms: Unauthenticated stored cross-site scripting via file upload
Summary
The Piotnet Forms WordPress plugin up to and including version 1.0.30 does not check form-submission file uploads and allows browser-renderable file types to be stored. An unauthenticated attacker can upload a file that runs arbitrary JavaScript in the site's origin when it is opened. The attack requires a public form with a file upload and someone, such as a staff member reviewing submissions, to open the stored file.
Affected
- Piotnet Forms WordPress plugin, all versions up to and including 1.0.30
- Vendor not confirmed by the CVE record (listed as Unknown)
Fixed in
Unknown. No fixed version confirmed by the vendor or WordPress.org. An aggregator recommends version 1.0.31 or later, which has not been verified.
Workaround
- No vendor workaround found.
- Deactivate or remove the plugin if it is not essential.
- Block direct access to the upload directory and serve uploads with a safe content type.
Exploitation
- Publicly disclosed on 2026-10-09 by WPScan (reporter Claude Ndanda).
- Public proof of concept: not confirmed.
- Known exploitation: none. Not listed in CISA KEV.
- CISA SSVC: exploitation none, automatable no. EPSS about 0.17%.
Our recommendation
- Identify all sites running Piotnet Forms and check the installed version.
- Deactivate the plugin where it is not needed, or remove it.
- Restrict access to the upload directory and check it for unexpected HTML, SVG or script files.
- Have staff open uploaded submissions only in a safe way, not in an admin browser session.
- Review recent form submissions and monitor for new uploads.
- Apply a vendor fix as soon as one is confirmed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan vulnerability entry wpscan.com
- OpenCVE CVE-2026-96227 app.opencve.io
- Vulners NVD CVE-2026-96227 vulners.com
- TheHackerWire CVE-2026-96227 www.thehackerwire.com
- Strix CVE-2026-96227 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:35.
Original description (NVD)
The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be stored, allowing unauthenticated attackers to store a file that executes arbitrary JavaScript in the site's origin when it is opened (Stored XSS).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.