{"uuid": "f44b55a7-5dd3-4d8b-a4f8-e5032ce474a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-96227", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117421007351097748", "content": "CVE-2026-96227 Piotnet Forms <= 1.0.30 - Unauthenticated Stored XSS via File Upload The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be stored, allowing unauthenticated attackers to store a file that executes arbitrary JavaScript in the site's origin when it is opened (Stored XSS).\nhttps://www.cve.org/CVERecord?id=CVE-2026-96227https://wpscan.com/vulnerability/90756840-b277-41bd-8104-16f839db5189/#CVE_2026_96227#bot", "creation_timestamp": "2026-10-11T07:06:23.312806Z"}