EUVD-2026-96795
GHSA-6pfh-rcm2-3cv3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate public form with file upload
-
DeliverySubmit crafted HTML/SVG payload unauthenticated
-
ExploitFile stored without validation
-
ExecutionVictim opens stored file
-
ImpactJavaScript executes in site origin
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the Piotnet Forms plugin (through 1.0.30) deployed with at least one publicly reachable form that exposes a file-upload field; exploitation needs no authentication and no special configuration to STORE the payload because the plugin neither authenticates nor validates the upload request and accepts browser-renderable types. The limiting factor is UI:R - the payload executes only when a victim (typically an admin viewing a submission, or any user following the file's direct URL) actually opens the stored file; it does not self-trigger. Highest impact occurs when the opener holds an authenticated admin session in the same origin. |
| Impact | Vendor CVSS is 8.8 (High) with AV:N/AC:L/PR:N, meaning remote, low-complexity, unauthenticated storage of the payload - a genuinely attractive profile because the write step needs no account. However, the exploit only fires on UI:R: a victim must actually open the stored file, so this is a stored XSS that fires on access, not a self-triggering RCE. The vendor's C:H/I:H/A:H impact rating is aggressive for a CWE-79 stored XSS with S:U; arbitrary JavaScript in the site origin can realistically hijack an authenticated admin session, but A:H (availability) is hard to justify and C/I are really bounded by what the executing script can reach, so the true base severity is likely lower than 8.8. No EPSS score and no CISA KEV entry were provided, so active-exploitation probability cannot be quantified from this data. A public exploit does exist (WPScan), which raises opportunistic risk, but POC availability is NOT the same as active exploitation. Net: a real, patch-worthy flaw for any site running this plugin with a file-upload form, but the UI:R requirement and niche footprint make it a targeted/opportunistic issue rather than a mass-exploitation emergency. Note conflict to verify: vendor-assigned A:H is inconsistent with a browser-side XSS and should be treated with caution. |
| Exploit ScenarioDerived | An unauthenticated attacker finds a public page using a Piotnet Forms form with a file-upload field and submits a browser-renderable file (e.g., an HTML or SVG document) containing malicious JavaScript, which the plugin stores without authentication or type validation. When a site administrator reviewing submissions - or any user - opens or navigates directly to that stored file, the JavaScript executes in the site's origin, enabling session/cookie theft or admin-session hijacking. A public exploit for this vector is available via WPScan, lowering the skill barrier. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Unauthenticated file-upload handling in the Piotnet Forms WordPress plugin through 1.0.30 lets an attacker store a browser-renderable file (HTML, SVG or similar) inside the site's own origin, so that opening the file executes arbitrary JavaScript - a stored XSS condition. The storage step requires no account and no special configuration, only a publicly reachable form that exposes an upload field; execution is not self-triggering and depends on a victim, typically an administrator reviewing a submission or any user following the file's direct URL, opening the payload (UI:R), with the highest impact when that opener holds an authenticated admin session in the same origin. Publicly available exploit code exists per the WPScan disclosure, and while the vendor-classified score is 8.8, our independent assessment scores the realistic vector lower (S:C, C:L/I:L) because the write and the execution are separated by user interaction and the observable impact depends on who opens the file.
RemediationAI
No vendor-released patch version is confirmed in the available data - the affected range is stated as through 1.0.30, so administrators should check the WPScan advisory (https://wpscan.com/vulnerability/90756840-b277-41bd-8104-16f839db5189/) for the current fixed release and upgrade to the earliest version above 1.0.30 as soon as it is published; if no fix is available, deactivate Piotnet Forms entirely, which is the only mitigation that fully closes the upload path at the cost of losing all forms on the site. If the plugin must stay online, remove or hide file-upload fields from every publicly reachable form and restrict submissions to authenticated users, and harden the uploads directory by rejecting renderable types (html, htm, svg, xml, xhtml, swf) at the web-server/WAF layer and forcing downloads on everything under /wp-content/uploads/ with Content-Disposition: attachment plus X-Content-Type-Options: nosniff - trade-offs being that legitimate document previews and inline images will break. Add a restrictive Content-Security-Policy (for example object-src 'none', script-src without 'unsafe-inline') to blunt any payload that is already stored, and note that a CSP with inline script allowed or SVG served from a separate cookie-bearing origin still leaves residual risk. Finally, treat prior submissions as potentially poisoned: search the uploads directory for unexpected HTML/SVG/XML files and delete them, and monitor plugin upload endpoints and administrator submission views in logs for the same pattern.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Piotnet Forms is a WordPress form-builder plugin; the flaw sits in the code path that accepts a form-submission file upload. That endpoint neither authenticates the request nor validates it (no capability or nonce check and an absent or ineffective extension/MIME allowlist), and it permits browser-renderable file types to be written into the site's uploads directory, which WordPress serves from the same origin as the application. The result is the CWE-79 class - improper neutralization of input during web page generation - manifesting as stored XSS: the stored file is inert until requested, at which point the browser parses it in the site's origin and runs any embedded script, giving an attacker same-origin JavaScript execution in the context of whoever opens it. In practice this class overlaps with unrestricted/dangerous file-type upload (CWE-434). Note the scoring divergence in the source data: the vendor figure of 8.8 reflects a changed-scope, high-integrity impact model, whereas our independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) keeps the unchanged attack profile of remote, low-complexity, unauthenticated write capability but treats confidentiality and integrity impact as limited because exploitation requires a victim to open the file. The CPE string records the product under an 'unknown' vendor namespace (cpe:2.3:a:unknown:piotnet_forms), and the issue is tracked in the EU as EUVD-2026-96795.
Know when Piotnet Forms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Unauthenticated remote storage gives AV:N/AC:L/PR:N; execution needs the victim to open the file (UI:R); XSS crosses into the browser context (S:C) with limited C/I and no genuine availability impact (A:N), unlike the vendor's C:H/I:H/A:H.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be stored, allowing unauthenticated attackers to store a file that executes arbitrary JavaScript in the site's origin when it is opened (Stored XSS).
Technical POC Analysis
CWE-79 (Stored XSS), reached through two independent defects in the plugin's form-submission file-upload handling.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
The Piotnet Forms WordPress plugin through 1.0.30 contains a high-severity stored XSS condition via file-upload handling, allowing an attacker to store browser-renderable files that execute JavaScript when a victim-typically an administrator reviewing a submission or any user following the file URL-opens them; publicly available exploit code exists and no vendor-released patch identified at time of analysis. Leadership should care because affected WordPress sites may face compromise of authenticated admin sessions in the same origin, and the lack of a vendor patch increases operational risk until mitigations are applied.
No vendor-released patch identified at time of analysis; interim mitigations include disabling or removing the Piotnet Forms plugin (versions through 1.0.30), taking public upload forms offline, blocking browser-renderable uploads (HTML, SVG, XML, etc.) at the WAF or web server, enforcing a strict file-type allowlist and Content-Disposition: attachment, and monitoring uploaded files and admin sessions for signs of compromise.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Piotnet Forms
View allArbitrary file upload in the Piotnet Forms WordPress plugin (all versions up to and including 2.1.40) allows unauthentic
The Piotnet Forms plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation
Unrestricted Upload of File with Dangerous Type vulnerability in Piotnet Piotnet Forms.0.25. Rated critical severity (CV
Exploit-DB