CVE-2025-57933

MediumCVSS 4.3

Published: 22/09/2025(UTC)Updated: 30/09/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

4th percentile - higher than 4% of all known CVEs

Summary

The Piotnet Forms WordPress plugin has a Cross-Site Request Forgery (CSRF) vulnerability that allows CSRF attacks. This affects all versions up to and including 1.0.30.

Risk Assessment

An attacker can exploit CSRF to perform unauthorized actions on behalf of an administrator, such as changing form settings or data.

Recommendation

Update the Piotnet Forms plugin to the latest version that includes the fix. Consider implementing additional CSRF protections.

Other vulnerabilities in Piotnet Forms

CVE-2026-96227High
The Piotnet Forms WordPress plugin through version 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be stored, allowing unauthenticated attackers to store a file that executes arbitrary JavaScript in the site's origin when it is opened (Stored XSS).

Original NVD description (English source)

Cross-Site Request Forgery (CSRF) vulnerability in piotnetdotcom Piotnet Forms piotnetforms allows Cross Site Request Forgery.This issue affects Piotnet Forms: from n/a through <= 1.0.30.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS