Is CVE-2026-96227 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-96227 being exploited in the wild.

How severe is CVE-2026-96227?

High severity, with a CVSS score of 8.8, published 11 October 2026.

Is there a fix for CVE-2026-96227?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-96227 attacked?

It is attacked over the network.

Am I affected by CVE-2026-96227?

Check whether you run Piotnet Forms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96227: Piotnet Forms unauthenticated stored XSS via file upload

CVE-2026-96227 · Severity: high · CVSS 8.8 · Published 2026-10-11

Piotnet Forms is a WordPress plugin for creating custom forms. The plugin fails to authenticate file uploads in form submissions and allows browser-executable files to be stored, letting unauthenticated attackers upload a malicious file that executes arbitrary JavaScript when opened. An attacker can exploit this to steal user credentials, deface the site, or compromise visitors.

Vendors: Piotnet.

Quick answers

Is CVE-2026-96227 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-96227 being exploited in the wild.
How severe is CVE-2026-96227?: High severity, with a CVSS score of 8.8, published 11 October 2026.
Which products and versions are affected?: Piotnet Forms through 1.0.30.
Is there a fix for CVE-2026-96227?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-96227 attacked?: It is attacked over the network.
Am I affected by CVE-2026-96227?: Check whether you run Piotnet Forms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The plugin lacks authentication and validation on form-submission file-upload endpoints, permitting unauthenticated attackers to upload browser-renderable file types (e.g., HTML, SVG). When a stored file is accessed, arbitrary JavaScript executes in the site's origin (stored XSS), giving the attacker access to session tokens, user data, or site administration. No patch is currently available.

Affected products

Piotnet Forms through 1.0.30

Timeline

2026-10-09: disclosed
2026-10-11: advisory

References

https://wpscan.com/vulnerability/90756840-b277-41bd-8104-16f839db5189/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.