{"id":"CVE-2026-96227","revision":"1f86fdd3b5cd40a9822118ac8fed3cb4","records":[{"revision":"1f86fdd3b5cd40a9822118ac8fed3cb4","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-96227","aliases":[],"title":"Piotnet Forms <= 1.0.30 - Unauthenticated Stored XSS via File Upload","description":"The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be stored, allowing unauthenticated attackers to store a file that executes arbitrary JavaScript in the site's origin when it is opened (Stored XSS).","state":0,"publishedAt":"2026-10-11T06:00:19.467+00:00","modifiedAt":"2026-10-11T11:32:40.13+00:00","affected":[{"ecosystem":"Vendor product","name":"Piotnet Forms","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Unknown\",\n                    \"product\": \"Piotnet Forms\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"version\": \"0\",\n                            \"lessThanOrEqual\": \"1.0.30\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unknown\"\n                }"}],"metrics":[],"references":["https://wpscan.com/vulnerability/90756840-b277-41bd-8104-16f839db5189/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-96227","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-96227","identifiers":["CVE-2026-96227"]},"retained":false,"historicalAffected":[]}],"coverage":[]}