Plugin — PoC Archivehttps://poc.intelseclab.com/tags/plugin/Latest proof-of-concept entries.Hugoen-usSun, 16 Aug 2026 00:00:00 +0000Apache Traffic Server Internal @Header Metadata Spoofing (CVE-2026-33267)https://poc.intelseclab.com/pocs/web/2026-08-16_cve-2026-33267-apache-trafficserver-header-spoof/Sun, 16 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-08-16_cve-2026-33267-apache-trafficserver-header-spoof/Critical severity (CVSS 10) — web · CVE-2026-33267 / GHSA-jrh6-9hgv-mqm7. Status: Patched (9.2.15 / 10.1.4). Affects: Apache Traffic Server. Tags: apache, traffic-server, ats, header-injection, metadata-spoof, cache-poisoning, acl-bypass, plugin, CVE-2026-33267.webCriticalapachetraffic-serveratsheader-injectionmetadata-spoofcache-poisoningacl-bypasspluginCVE-2026-33267YayMail WooCommerce Plugin Missing Authorization to Privilege Escalation — CVE-2026-1937https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1937-yaymail-woocommerce-privesc/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1937-yaymail-woocommerce-privesc/High severity (CVSS 7.2) — web · CVE-2026-1937. Status: Weaponized. Affects: YayMail – WooCommerce Email Customizer plugin for WordPress. Tags: wordpress, woocommerce, plugin, missing-authorization, privilege-escalation, mass-exploitation, ajax.webHighwordpresswoocommercepluginmissing-authorizationprivilege-escalationmass-exploitationajaxWP Captcha PRO Subscriber-to-Administrator Authentication Bypass — CVE-2026-5415https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5415-wp-captcha-pro-auth-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5415-wp-captcha-pro-auth-bypass/High severity (CVSS 8.8) — web · CVE-2026-5415. Status: PoC. Affects: WP Captcha PRO (WordPress plugin, Advanced Google reCAPTCHA). Tags: wordpress, wp-captcha-pro, auth-bypass, privilege-escalation, nonce, ajax, account-takeover, plugin.webHighwordpresswp-captcha-proauth-bypassprivilege-escalationnonceajaxaccount-takeoverpluginWordPress Contest Gallery Plugin Unauthenticated Blind SQL Injection — CVE-2026-3180https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3180-contest-gallery-blind-sqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3180-contest-gallery-blind-sqli/High severity — web · CVE-2026-3180. Status: PoC. Affects: WordPress "Contest Gallery" plugin. Tags: wordpress, sqli, blind-sqli, plugin, admin-ajax, unauthenticated, php, boolean-based.webHighwordpresssqliblind-sqlipluginadmin-ajaxunauthenticatedphpboolean-basedWordPress "Import and Export Users and Customers" Plugin Privilege Escalation (CVE-2026-3629)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3629-wordpress-privilege-escalation/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3629-wordpress-privilege-escalation/Critical severity — web · CVE-2026-3629. Status: PoC. Affects: Import and Export Users and Customers (WordPress plugin). Tags: wordpress, privilege-escalation, plugin, import-export-users, cwe-269.webCriticalwordpressprivilege-escalationpluginimport-export-userscwe-269WooCommerce Wholesale Lead Capture — Unauthenticated Privilege Escalation & File Upload RCE (CVE-2026-27542 / CVE-2026-27540)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27542-woocommerce-wwlc-privesc-fileupload/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27542-woocommerce-wwlc-privesc-fileupload/Critical severity (CVSS 9.8) — web · CVE-2026-27542 (bundled with CVE-2026-27540). Status: Weaponized. Affects: WooCommerce Wholesale Lead Capture (WWLC) plugin for WordPress. Tags: wordpress, woocommerce, plugin, privilege-escalation, file-upload, rce, unauthenticated, mass-scanning.webCriticalwordpresswoocommercepluginprivilege-escalationfile-uploadrceunauthenticatedmass-scanningUpdraftPlus WordPress Plugin — Unauthenticated RPC Key Bypass to Admin Creation & RCE (CVE-2026-10795)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-10795-updraftplus-rpc-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-10795-updraftplus-rpc-rce/Critical severity — web · CVE-2026-10795. Status: Weaponized. Affects: UpdraftPlus (WordPress backup plugin) — UpdraftCentral remote RPC feature. Tags: wordpress, plugin, updraftplus, rpc, unauthenticated, admin-takeover, plugin-upload, rce, mass-exploitation.webCriticalwordpresspluginupdraftplusrpcunauthenticatedadmin-takeoverplugin-uploadrcemass-exploitationSnow Monkey Forms — Unauthenticated Arbitrary File Deletion via Path Traversal (CVE-2026-1056)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1056-snow-monkey-forms-file-deletion/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1056-snow-monkey-forms-file-deletion/Critical severity — web · CVE-2026-1056. Status: PoC. Affects: Snow Monkey Forms (WordPress plugin). Tags: wordpress, plugin, snow-monkey-forms, path-traversal, file-deletion, unauthenticated, rest-api, csrf-bypass.webCriticalwordpresspluginsnow-monkey-formspath-traversalfile-deletionunauthenticatedrest-apicsrf-bypassSimple File List Plugin Unauthenticated File Modification / Path Traversal — CVE-2026-11912https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-11912-simple-file-list-path-traversal/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-11912-simple-file-list-path-traversal/High severity (CVSS 7.5) — web · CVE-2026-11912. Status: PoC. Affects: Simple File List WordPress plugin. Tags: wordpress, plugin, path-traversal, missing-authorization, unauthenticated, file-deletion, ajax, nonce.webHighwordpresspluginpath-traversalmissing-authorizationunauthenticatedfile-deletionajaxnonceProdigy Commerce WordPress Plugin — Unauthenticated Local File Inclusion (CVE-2026-0926)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0926-prodigy-commerce-lfi/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0926-prodigy-commerce-lfi/High severity — web · CVE-2026-0926. Status: PoC. Affects: Prodigy Commerce (WordPress plugin). Tags: wordpress, plugin, prodigy-commerce, lfi, local-file-inclusion, unauthenticated, ajax.webHighwordpresspluginprodigy-commercelfilocal-file-inclusionunauthenticatedajaxPerfmatters WordPress Plugin Arbitrary File Deletion (CVE-2026-4350)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4350-perfmatters-file-deletion/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4350-perfmatters-file-deletion/High severity (CVSS 8.1) — web · CVE-2026-4350. Status: PoC. Affects: Perfmatters WordPress plugin. Tags: wordpress, plugin, perfmatters, path-traversal, arbitrary-file-deletion, admin-ajax, dos, nuclei.webHighwordpresspluginperfmatterspath-traversalarbitrary-file-deletionadmin-ajaxdosnucleiNextScripts Social Networks Auto-Poster — WordPress Stored XSS (CVE-2026-3228)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3228-nextscripts-wp-stored-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3228-nextscripts-wp-stored-xss/Medium severity (CVSS 6.4) — web · CVE-2026-3228. Status: PoC. Affects: NextScripts: Social Networks Auto-Poster (WordPress plugin). Tags: wordpress, xss, stored-xss, plugin, contributor-privilege, shortcode, session-hijacking.webMediumwordpressxssstored-xssplugincontributor-privilegeshortcodesession-hijackingLatePoint Calendar Booking Plugin Contributor-to-Administrator Privilege Escalation (CVE-2026-49083)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49083-latepoint-privilege-escalation/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49083-latepoint-privilege-escalation/High severity (CVSS 8.8) — web · CVE-2026-49083. Status: PoC. Affects: LatePoint Calendar Booking plugin for WordPress. Tags: wordpress, latepoint, privilege-escalation, plugin, ajax, python, authenticated.webHighwordpresslatepointprivilege-escalationpluginajaxpythonauthenticatedLA-Studio Element Kit for Elementor — Unauthenticated Admin Account Creation (CVE-2026-0920)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0920-lakit-elementor-privesc/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0920-lakit-elementor-privesc/Critical severity (CVSS 9.8) — web · CVE-2026-0920. Status: Weaponized. Affects: LA-Studio Element Kit for Elementor (WordPress plugin, slug lakit). Tags: wordpress, plugin, elementor, privilege-escalation, admin-takeover, unauthenticated, ajax, wp-ajax.webCriticalwordpresspluginelementorprivilege-escalationadmin-takeoverunauthenticatedajaxwp-ajaxHustle (WordPress Popup) Authenticated Arbitrary File Upload via Module Import (CVE-2026-0911)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0911-hustle-wordpress-upload/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0911-hustle-wordpress-upload/High severity — web · CVE-2026-0911. Status: PoC. Affects: Hustle (wordpress-popup) plugin by WPMU DEV. Tags: wordpress, hustle, plugin, file-upload, rce, wp_handle_upload, orphan-file, authenticated, cwe-434.webHighwordpresshustlepluginfile-uploadrcewp_handle_uploadorphan-fileauthenticatedcwe-434Hippoo Mobile App for WooCommerce — Unauthenticated Admin Account Takeover (CVE-2026-10580)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-10580-hippoo-woocommerce-authbypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-10580-hippoo-woocommerce-authbypass/Critical severity (CVSS 9.8) — web · CVE-2026-10580. Status: Weaponized. Affects: Hippoo Mobile App for WooCommerce (WordPress plugin). Tags: wordpress, plugin, woocommerce, hippoo, authentication-bypass, account-takeover, rest-api, unauthenticated.webCriticalwordpresspluginwoocommercehippooauthentication-bypassaccount-takeoverrest-apiunauthenticatedElementsKit Elementor Addons Authenticated Stored XSS via REST API (CVE-2026-2600)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-2600-elementskit-stored-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-2600-elementskit-stored-xss/Medium severity (CVSS 6.4) — web · CVE-2026-2600. Status: Weaponized. Affects: ElementsKit Elementor Addons (WordPress plugin). Tags: wordpress, elementor, stored-xss, rest-api, privilege-escalation, contributor, plugin, cwe-79.webMediumwordpresselementorstored-xssrest-apiprivilege-escalationcontributorplugincwe-79Branda White Label & Branding Plugin Unauthenticated Account Takeover — CVE-2026-11551https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-11551-branda-wp-account-takeover/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-11551-branda-wp-account-takeover/Critical severity (CVSS 9.8) — web · CVE-2026-11551. Status: Weaponized. Affects: Branda White Label & Branding WordPress plugin. Tags: wordpress, plugin, account-takeover, privilege-escalation, unauthenticated, multisite, branda.webCriticalwordpresspluginaccount-takeoverprivilege-escalationunauthenticatedmultisitebranda