CVE-2026-96227

Name of the Vulnerable Software and Affected Versions Piotnet Forms versions prior to 1.0.31

Description The plugin fails to authenticate or validate file-upload requests during form submissions. This allows unauthenticated attackers to upload and store browser-renderable files containing arbitrary JavaScript. When these files are opened, the script executes within the site's origin, resulting in Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server.

Recommendations Update the plugin to version 1.0.31 or later.