The Piotnet Forms WordPress plugin up to version 1.0.30 does not require authentication when handling file‑upload form submissions. If a browser‑renderable file type is uploaded, it is stored on the site and can be accessed by visitors. When a victim opens or views the stored file, the embedded JavaScript executes in the site’s origin, allowing the attacker to steal session cookies, deface content, or perform other malicious actions in the context of the legitimate site. This weakness is identified as a stored cross‑site scripting vulnerability.

All installations of the Piotnet Forms WordPress plugin with a version of 1.0.30 or earlier are affected. The flaw is confined to the plugin; the core WordPress installation is not directly vulnerable unless the plugin’s upload directory is exposed. The vendor listing appears as Unknown:Piotnet Forms in the CVE record.

Based on the description, it is inferred that the attack vector involves an unauthenticated attacker sending a crafted POST request to the plugin’s upload endpoint, uploading a file that contains malicious JavaScript. The attacker then needs a victim to open or browse a page that serves that stored file. The CVSS score of 8.8 reflects high impact while the EPSS score of less than 1 % indicates a low probability of active exploitation at present. The vulnerability is not listed in CISA’s KEV catalog, suggesting that no confirmed widespread exploitation has been reported. The risk to affected sites includes potential loss of confidentiality, integrity, and availability for all visitors who encounter the stored payload.