Plugin-Vulnerability — PoC Archivehttps://poc.intelseclab.com/tags/plugin-vulnerability/Latest proof-of-concept entries.Hugoen-usSun, 05 Jul 2026 00:00:00 +0000WordPress User Language Switch Plugin SSRF — CVE-2026-0745https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0745-uls-plugin-ssrf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0745-uls-plugin-ssrf/Medium severity — web · CVE-2026-0745 (GHSA-m38c-5p3m-p7gm). Status: PoC. Affects: WordPress "User Language Switch" plugin. Tags: wordpress, ssrf, plugin-vulnerability, admin-ajax, cwe-918, metadata-endpoint.webMediumwordpressssrfplugin-vulnerabilityadmin-ajaxcwe-918metadata-endpointWordPress Ninja Forms Plugin Unauthenticated File Upload — CVE-2026-0740https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0740-ninja-forms-file-upload/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0740-ninja-forms-file-upload/High severity — web · CVE-2026-0740. Status: PoC. Affects: WordPress "Ninja Forms" plugin — file upload field/module. Tags: wordpress, ninja-forms, file-upload, webshell, admin-ajax, plugin-vulnerability, cwe-434.webHighwordpressninja-formsfile-uploadwebshelladmin-ajaxplugin-vulnerabilitycwe-434WordPress HT Mega (Absolute Addons for Elementor) Unauthenticated PII Disclosure (CVE-2026-4106)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4106-htmega-wordpress-pii-disclosure/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4106-htmega-wordpress-pii-disclosure/High severity — web · CVE-2026-4106. Status: Weaponized. Affects: HT Mega – Absolute Addons for Elementor (WordPress plugin). Tags: wordpress, elementor, ht-mega, wp-ajax, pii-disclosure, missing-authorization, mass-scanner, plugin-vulnerability.webHighwordpresselementorht-megawp-ajaxpii-disclosuremissing-authorizationmass-scannerplugin-vulnerabilityWordPress "List Site Contributors" Plugin Reflected XSS Scanner (CVE-2026-0594)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0594-listsitecontributors-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0594-listsitecontributors-xss/Medium severity — web · CVE-2026-0594. Status: PoC. Affects: "List Site Contributors" WordPress plugin. Tags: wordpress, xss, reflected-xss, wp-json, rest-api, plugin-vulnerability, golang, scanner.webMediumwordpressxssreflected-xsswp-jsonrest-apiplugin-vulnerabilitygolangscanner