Claude Ndanda

**Name of the Vulnerable Software and Affected Versions** Piotnet Forms versions prior to 1.0.31 **Description** The plugin fails to authenticate or validate file-upload requests during form submissions. This allows unauthenticated attackers to upload and store browser-renderable files containing arbitrary JavaScript. When these files are opened, the script executes within the site's origin, resulting in Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. **Recommendations** Update the plugin to version 1.0.31 or later.