HIGH 8.8 NVD

CVE-2026-96227

The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file ty

The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be stored, allowing unauthenticated attackers to store a file that executes arbitrary JavaScript in the site's origin when it is opened (Stored XSS).

References

https://wpscan.com/vulnerability/90756840-b277-41bd-8104-16f839db5189/

Published: 2026-10-11 · Source: NVD · Feed updated: 2026-10-12

This high severity vulnerability with a CVSS score of 8.8 was published on 2026-10-11 via NVD.

vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.