PoC Archive PoC Archive

tag

CWE-79

WordPress — Pre-Auth XSS to RCE Chain via Login Page Parser Differential (CVE-2026-64638, "XSS2Shell") EPSS 31%
CVE-2026-64638 web Unverified
CVE-2026-64638webHIGH 8.9Unverified2026-08-09WP Time Slots Booking Form Unauthenticated Stored XSS (CVE-2026-40791)
CVE-2026-40791 web Patched
CVE-2026-40791webHIGH 7.2Patched2026-07-05TypiCMS Core — Stored XSS via Unsanitized SVG File Upload (CVE-2026-27621)
CVE-2026-27621 (GHSA-xfvg-8v67-j7wp) web Patched
CVE-2026-27621webMEDIUMPatched2026-07-05School Management System 1.0 — Reflected XSS in register.php (CVE-2026-37750)
CVE-2026-37750 web Unverified
CVE-2026-37750webMEDIUM 6.1Unverified2026-07-05Saleor Rich Text (EditorJS) Field Stored XSS (CVE-2026-22849)
CVE-2026-22849 (GHSA-8jcj-r5g2-qrpv) web Patched
CVE-2026-22849webHIGHPatched2026-07-05oRPC OpenAPI Reference Plugin Stored XSS via Unescaped Spec Embedding (CVE-2026-33331)
CVE-2026-33331 (GHSA-7f6v-3gx7-27q8) web Patched
CVE-2026-33331webHIGHPatched2026-07-05OpenSTAManager Reflected XSS via `righe` Parameter (CVE-2026-24415)
CVE-2026-24415 (GHSA-jfgp-g7x7-j25j) web Patched
CVE-2026-24415webMEDIUMPatched2026-07-05Gravity Forms Unauthenticated Reflected XSS via `gform_get_config` `form_ids` Parameter (CVE-2026-4406)
CVE-2026-4406 web Patched
CVE-2026-4406webMEDIUM 6.1Patched2026-07-05ElementsKit Elementor Addons Authenticated Stored XSS via REST API (CVE-2026-2600)
CVE-2026-2600 web Patched
CVE-2026-2600webMEDIUM 6.4Patched2026-07-05Bookly Booking Form Cookie-Based Stored XSS — CVE-2026-5513
CVE-2026-5513 web Patched
CVE-2026-5513webHIGH 7.2Patched2026-07-05