https://poc.intelseclab.com/tags/cwe-79/Latest proof-of-concept entries.Hugoen-usSun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2026-64638-wordpress-xss2shell-pre-auth-xss-to-rce/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2026-64638-wordpress-xss2shell-pre-auth-xss-to-rce/High severity (CVSS 8.9) — web · CVE-2026-64638. Status: Patched. Affects: WordPress Core, wp-login.php failed-login error message, KSES sanitizer vs PHP strip_tags(). Tags: wordpress, wordpress-core, pre-auth, xss, reflected-xss, xss2shell, rce, parser-differential, dom-clobbering, some, jsonp, rest-api, application-password, plugin-upload, CWE-79, CWE-94, cms.webHighwordpresswordpress-corepre-authxssreflected-xssxss2shellrceparser-differentialdom-clobberingsomejsonprest-apiapplication-passwordplugin-uploadCWE-79CWE-94cmshttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-40791-wp-time-slots-booking-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-40791-wp-time-slots-booking-xss/High severity (CVSS 7.2) — web · CVE-2026-40791. Status: PoC. Affects: WP Time Slots Booking Form (wp-time-slots-booking-form WordPress plugin). Tags: wordpress, wordpress-plugin, stored-xss, unauthenticated, cwe-79, admin-takeover, booking-form.webHighwordpresswordpress-pluginstored-xssunauthenticatedcwe-79admin-takeoverbooking-formhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27621-typicms-svg-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27621-typicms-svg-xss/Medium severity — web · CVE-2026-27621 (GHSA-xfvg-8v67-j7wp). Status: PoC. Affects: TypiCMS Core (typicms/core). Tags: typicms, stored-xss, svg-upload, cwe-79, cms, file-upload, laravel, session-hijack.webMediumtypicmsstored-xsssvg-uploadcwe-79cmsfile-uploadlaravelsession-hijackhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-37750-school-management-system-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-37750-school-management-system-xss/Medium severity (CVSS 6.1) — web · CVE-2026-37750. Status: PoC. Affects: School Management System (mahmoudai1) 1.0. Tags: php, reflected-xss, cwe-79, unauthenticated, cookie-theft, school-management-system.webMediumphpreflected-xsscwe-79unauthenticatedcookie-theftschool-management-systemhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-22849-saleor-richtext-stored-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-22849-saleor-richtext-stored-xss/High severity — web · CVE-2026-22849 (GHSA-8jcj-r5g2-qrpv). Status: PoC. Affects: Saleor (open-source e-commerce platform), rich text fields (EditorJS content on pages/products). Tags: saleor, stored-xss, editorjs, graphql, ecommerce, session-hijacking, cwe-79.webHighsaleorstored-xsseditorjsgraphqlecommercesession-hijackingcwe-79https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33331-orpc-openapi-stored-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33331-orpc-openapi-stored-xss/High severity — web · CVE-2026-33331 (GHSA-7f6v-3gx7-27q8). Status: PoC. Affects: middleapi/orpc — OpenAPI documentation reference plugin (packages/openapi/src/plugins/openapi-reference.ts). Tags: xss, stored-xss, orpc, openapi, cwe-79, javascript, nodejs, docs-page.webHighxssstored-xssorpcopenapicwe-79javascriptnodejsdocs-pagehttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24415-openstamanager-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24415-openstamanager-xss/Medium severity — web · CVE-2026-24415 (GHSA-jfgp-g7x7-j25j). Status: PoC. Affects: OpenSTAManager (devcode-it/openstamanager). Tags: xss, reflected-xss, openstamanager, cwe-79, session-hijacking, php, unauthenticated-payload.webMediumxssreflected-xssopenstamanagercwe-79session-hijackingphpunauthenticated-payloadhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4406-gravity-forms-reflected-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4406-gravity-forms-reflected-xss/Medium severity (CVSS 6.1) — web · CVE-2026-4406. Status: PoC. Affects: Gravity Forms (WordPress plugin) by Rocketgenius, Inc.. Tags: wordpress, gravity-forms, xss, reflected-xss, admin-ajax, unauthenticated, cwe-79.webMediumwordpressgravity-formsxssreflected-xssadmin-ajaxunauthenticatedcwe-79https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-2600-elementskit-stored-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-2600-elementskit-stored-xss/Medium severity (CVSS 6.4) — web · CVE-2026-2600. Status: Weaponized. Affects: ElementsKit Elementor Addons (WordPress plugin). Tags: wordpress, elementor, stored-xss, rest-api, privilege-escalation, contributor, plugin, cwe-79.webMediumwordpresselementorstored-xssrest-apiprivilege-escalationcontributorplugincwe-79https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5513-bookly-cookie-stored-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5513-bookly-cookie-stored-xss/High severity (CVSS 7.2) — web · CVE-2026-5513. Status: PoC. Affects: Bookly — Online Scheduling and Appointment Booking System (WordPress plugin). Tags: wordpress, bookly, stored-xss, cwe-79, cookie-injection, appointment-booking.webHighwordpressbooklystored-xsscwe-79cookie-injectionappointment-booking