CVE-2026-96227

19th percentile - higher than 19% of all known CVEs

The Piotnet Forms WordPress plugin through version 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be stored, allowing unauthenticated attackers to store a file that executes arbitrary JavaScript in the site's origin when it is opened (Stored XSS).

The risk includes the possibility of executing malicious scripts in the site's context, which can lead to data theft, user session hijacking, or malware distribution. The attack can be performed without authentication.

Update the Piotnet Forms plugin to the latest version if available. Also restrict allowed file types to safe formats (e.g., images) and implement server-side validation.