CVE-2026-96227

Summary

The Piotnet Forms WordPress plugin allows unauthenticated attackers to upload files that execute arbitrary JavaScript when opened, leading to Stored Cross-Site Scripting (XSS) attacks. This vulnerability is particularly dangerous because it enables attackers to inject malicious code that can hijack user sessions or redirect them to malicious sites.

Exploitability

Exploitation is relatively straightforward as attackers only need to upload a malicious file through the form submission endpoint without authentication, with no additional preconditions required.

Blast radius

The impact could be significant across all WordPress sites using the affected plugin version, potentially compromising user sessions and enabling further attacks through persistent XSS payloads stored on the server.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.0.31 or later which includes authentication and validation for form-submission file uploads.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.