Reflected-Xss — PoC Archivehttps://poc.intelseclab.com/tags/reflected-xss/Latest proof-of-concept entries.Hugoen-usSun, 09 Aug 2026 00:00:00 +0000WordPress — Pre-Auth XSS to RCE Chain via Login Page Parser Differential (CVE-2026-64638, "XSS2Shell")https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2026-64638-wordpress-xss2shell-pre-auth-xss-to-rce/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2026-64638-wordpress-xss2shell-pre-auth-xss-to-rce/High severity (CVSS 8.9) — web · CVE-2026-64638. Status: Patched. Affects: WordPress Core, wp-login.php failed-login error message, KSES sanitizer vs PHP strip_tags(). Tags: wordpress, wordpress-core, pre-auth, xss, reflected-xss, xss2shell, rce, parser-differential, dom-clobbering, some, jsonp, rest-api, application-password, plugin-upload, CWE-79, CWE-94, cms.webHighwordpresswordpress-corepre-authxssreflected-xssxss2shellrceparser-differentialdom-clobberingsomejsonprest-apiapplication-passwordplugin-uploadCWE-79CWE-94cmsWordPress "List Site Contributors" Plugin Reflected XSS Scanner (CVE-2026-0594)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0594-listsitecontributors-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0594-listsitecontributors-xss/Medium severity — web · CVE-2026-0594. Status: PoC. Affects: "List Site Contributors" WordPress plugin. Tags: wordpress, xss, reflected-xss, wp-json, rest-api, plugin-vulnerability, golang, scanner.webMediumwordpressxssreflected-xsswp-jsonrest-apiplugin-vulnerabilitygolangscannerSchool Management System 1.0 — Reflected XSS in register.php (CVE-2026-37750)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-37750-school-management-system-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-37750-school-management-system-xss/Medium severity (CVSS 6.1) — web · CVE-2026-37750. Status: PoC. Affects: School Management System (mahmoudai1) 1.0. Tags: php, reflected-xss, cwe-79, unauthenticated, cookie-theft, school-management-system.webMediumphpreflected-xsscwe-79unauthenticatedcookie-theftschool-management-systemOpenSTAManager Reflected XSS via `righe` Parameter (CVE-2026-24415)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24415-openstamanager-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24415-openstamanager-xss/Medium severity — web · CVE-2026-24415 (GHSA-jfgp-g7x7-j25j). Status: PoC. Affects: OpenSTAManager (devcode-it/openstamanager). Tags: xss, reflected-xss, openstamanager, cwe-79, session-hijacking, php, unauthenticated-payload.webMediumxssreflected-xssopenstamanagercwe-79session-hijackingphpunauthenticated-payloadGravity Forms Unauthenticated Reflected XSS via `gform_get_config` `form_ids` Parameter (CVE-2026-4406)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4406-gravity-forms-reflected-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4406-gravity-forms-reflected-xss/Medium severity (CVSS 6.1) — web · CVE-2026-4406. Status: PoC. Affects: Gravity Forms (WordPress plugin) by Rocketgenius, Inc.. Tags: wordpress, gravity-forms, xss, reflected-xss, admin-ajax, unauthenticated, cwe-79.webMediumwordpressgravity-formsxssreflected-xssadmin-ajaxunauthenticatedcwe-79