Piotnet Forms

Piotnet Forms has 7 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2025; 3 are fixed and 4 remain unpatched as of September 2026. Their average CVSS score is 6.2, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 1 high. 2025 was the busiest year with 4 disclosures.

The most common weakness is Cross-Site Scripting, behind 2 of the records (29%). Other recurring categories include Unrestricted Upload Of File With Dangerous Type, Cross-Site Request Forgery (CSRF).

3 of the records (43%) have a vendor fix, while 4 remain unpatched. The oldest unresolved one dates back to 2025.

7 independent researchers contributed these findings, one record each. Piotnet Forms is installed on roughly 2,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.5.10.

Strategic Overview

Avg CVSSMedium

6.2/ 10

Patch Coverage43%

Open

Fixed

Get automatic notifications for all Piotnet Forms vulnerabilities before they are exploited.

Most severe open issueCVSS 6.4CVE-2025-31792

Piotnet Forms <= 1.0.30 - Authenticated (Author+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

7 records


2025-09-22 00:00	Piotnet Forms <= 1.0.30 - Cross-Site Request Forgery Piotnet Forms <= 1.0.30	`CVE-2025-57933`	4.3 Medium	Bao - BlueRock	No
2025-04-07 00:00	Piotnet Forms <= 1.0.30 - Authenticated (Editor+) Path Traversal Piotnet Forms <= 1.0.30	`CVE-2025-32205`	3.8 Low	Trương Hữu Phúc (truonghuuphuc)	No
2025-04-01 00:00	Piotnet Forms <= 1.0.30 - Authenticated (Editor+) Stored Cross-Site Scripting Piotnet Forms <= 1.0.30	`CVE-2025-31793`	4.4 Medium	Thái An	No
2025-04-01 00:00	Piotnet Forms <= 1.0.30 - Authenticated (Author+) Stored Cross-Site Scripting Piotnet Forms <= 1.0.30	`CVE-2025-31792`	6.4 Medium	Michael	No
2023-12-27 00:00	Piotnet Forms Plugin <= 1.0.28 - Unauthenticated Arbitrary File Upload Piotnet Forms <= 1.0.28	`CVE-2023-51412`	9.8 Critical	Rafie Muhammad	Yes
2023-12-27 00:00	Piotnet Forms <= 1.0.25 - Missing Authorization via multiple AJAX actions Piotnet Forms <= 1.0.29	`CVE-2023-51413`	6.5 Medium	Abdi Pranata	Yes
2023-12-04 00:00	Piotnet Forms <= 1.0.28 - Unauthenticated Arbitrary File Upload Piotnet Forms <= 1.0.28	`CVE-2023-6220`	8.1 High	István Márton	Yes

Showing 1–7 of 7 reports

Latestv1.0.30

Piotnet Forms

Author

piotnetdotcom

3.9(21)

78/100

Last Updated

2024-02-22 (3y ago)

Active Installs

2,000+

Downloads

50,984

Requires WP

4.7+

Requires PHP

5.4+

Tested up to

WP 6.5.10

Created

2020-09-18 (6y ago)

Piotnet Forms – Highly Customizable WordPress Form Builder The Fastest Free WP Form Builder – Only load JS/CSS (7KB JS, 5KB CSS) when form shortcode is present Free Features With Free Version you can build professional landing page with just Drag & Drop without writing any code. Easily Customizable Responsive Border, Padding, Margin, Color for Field, Submit Button. Basic Fields Submit Button: Email, Email 2 Section, Column Text Import, Export Templates Pro Features Booking Repeater Fields Multi Level Nested Register and Login Form Builder Update User Profile Woocommerce One Page Checkout Woocommerce Dynamic Pricing Submit Post & Edit Post Form Builder Signature Field Form Abandonment Label Animation reCAPTCHA (v3) Integration Multi Step Form Stripe Payment Paypal Payment Conditional Logic Form Calculated Fields Form Preview Submission Image Select Field Coupon Code Field Input Mask Distance Calculation PDF Generator Form Database Google Maps Address Autocomplete Field Range Slider Field Date range calculated fields Webhook (It can connect to your Endpoint URL, Zapier) Remote Request Google Sheets MailerLite Getresponse Mailpoet Zoho CRM MailChimp ActiveCampaign

View on WordPress.org