Stored Cross-Site Scripting Vulnerability in Piotnet Forms WordPress Plugin by Piotnet
CVE-2026-96227

Currently unrated

Key Information:

Vendor

WordPress
Status
Piotnet Forms
Vendor
CVE Published:
11 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-96227?

The Piotnet Forms WordPress plugin, versions up to 1.0.30, has a critical flaw that allows unvalidated file uploads. This vulnerability enables malicious users to upload files that can execute arbitrary JavaScript code within the site's domain when accessed. As a result, this stored XSS issue poses a serious risk, potentially leading to unauthorized access and compromising user security.

Affected Version(s)

Piotnet Forms 0 <= 1.0.30

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-96227 - Proof of Concept

References

https://wpscan.com/vulnerability/90756840-b277-41bd-8104-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Claude Ndanda (TrixX)
WPScan
.