Plugin-Upload — PoC Archivehttps://poc.intelseclab.com/tags/plugin-upload/Latest proof-of-concept entries.Hugoen-usSun, 09 Aug 2026 00:00:00 +0000WordPress — Pre-Auth XSS to RCE Chain via Login Page Parser Differential (CVE-2026-64638, "XSS2Shell")https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2026-64638-wordpress-xss2shell-pre-auth-xss-to-rce/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2026-64638-wordpress-xss2shell-pre-auth-xss-to-rce/High severity (CVSS 8.9) — web · CVE-2026-64638. Status: Patched. Affects: WordPress Core, wp-login.php failed-login error message, KSES sanitizer vs PHP strip_tags(). Tags: wordpress, wordpress-core, pre-auth, xss, reflected-xss, xss2shell, rce, parser-differential, dom-clobbering, some, jsonp, rest-api, application-password, plugin-upload, CWE-79, CWE-94, cms.webHighwordpresswordpress-corepre-authxssreflected-xssxss2shellrceparser-differentialdom-clobberingsomejsonprest-apiapplication-passwordplugin-uploadCWE-79CWE-94cmsUpdraftPlus WordPress Plugin — Unauthenticated RPC Key Bypass to Admin Creation & RCE (CVE-2026-10795)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-10795-updraftplus-rpc-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-10795-updraftplus-rpc-rce/Critical severity — web · CVE-2026-10795. Status: Weaponized. Affects: UpdraftPlus (WordPress backup plugin) — UpdraftCentral remote RPC feature. Tags: wordpress, plugin, updraftplus, rpc, unauthenticated, admin-takeover, plugin-upload, rce, mass-exploitation.webCriticalwordpresspluginupdraftplusrpcunauthenticatedadmin-takeoverplugin-uploadrcemass-exploitationBudibase Authentication Bypass to Plugin-Upload Reverse Shell — CVE-2026-31816https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-31816-budibase-auth-bypass-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-31816-budibase-auth-bypass-rce/Critical severity — web · CVE-2026-31816. Status: Weaponized. Affects: Budibase (low-code platform). Tags: budibase, auth-bypass, rce, plugin-upload, reverse-shell, low-code, python, datasource-plugin.webCriticalbudibaseauth-bypassrceplugin-uploadreverse-shelllow-codepythondatasource-plugin