PoC Archive PoC Archive

tag

Stored-Xss

High
WP Time Slots Booking Form Unauthenticated Stored XSS (CVE-2026-40791)
CVE-2026-40791· WP Time Slots Booking Form (wp-time-slots-booking-form WordPress plugin) patched
High
VvvebJs SVG Upload Stored Cross-Site Scripting — CVE-2026-5615
CVE-2026-5615· VvvebJs (drag-and-drop website builder) unpatched
Medium
TypiCMS Core — Stored XSS via Unsanitized SVG File Upload (CVE-2026-27621)
CVE-2026-27621 (GHSA-xfvg-8v67-j7wp)· TypiCMS Core (typicms/core) patched
High
Termix Stored XSS via Malicious SVG Upload -> LFI / Session Hijack (CVE-2026-22804 / GHSA-m3cv-5hgp-hv35)
CVE-2026-22804 (GHSA-m3cv-5hgp-hv35)· Termix (Electron-based SSH/terminal manager), File Manager component (FileViewer.tsx) patched
High
Saleor Stored XSS via Unrestricted File Upload (CVE-2026-23499)
CVE-2026-23499· Saleor (saleor/saleor) patched
High
Saleor Rich Text (EditorJS) Field Stored XSS (CVE-2026-22849)
CVE-2026-22849 (GHSA-8jcj-r5g2-qrpv)· Saleor (open-source e-commerce platform), rich text fields (EditorJS content on pages/products) unpatched
High
Postiz Arbitrary File Upload to Stored XSS / Account Takeover (CVE-2026-40487)
CVE-2026-40487 / GHSA-44wg-r34q-hvfx· Postiz (open-source social media management platform, gitroomhq/postiz-app) patched
High
oRPC OpenAPI Reference Plugin Stored XSS via Unescaped Spec Embedding (CVE-2026-33331)
CVE-2026-33331 (GHSA-7f6v-3gx7-27q8)· middleapi/orpc — OpenAPI documentation reference plugin (packages/openapi/src/plugins/openapi-reference.ts) patched
Medium
NextScripts Social Networks Auto-Poster — WordPress Stored XSS (CVE-2026-3228)
CVE-2026-3228· NextScripts: Social Networks Auto-Poster (WordPress plugin) unpatched
High
Immich Stored XSS to API Key Exfiltration and Account Hijacking (CVE-2026-35455)
CVE-2026-35455· Immich (self-hosted photo/video management) unpatched
Medium
EspoCRM 9.3.3 Stored HTML Injection in Email Notifications — CVE-2026-33657
CVE-2026-33657· EspoCRM 9.3.3 patched
Medium
ElementsKit Elementor Addons Authenticated Stored XSS via REST API (CVE-2026-2600)
CVE-2026-2600· ElementsKit Elementor Addons (WordPress plugin) patched
High
Bookly Booking Form Cookie-Based Stored XSS — CVE-2026-5513
CVE-2026-5513· Bookly — Online Scheduling and Appointment Booking System (WordPress plugin) patched
Critical
BentoPDF Stored XSS to File Exfiltration (CVE-2026-41653)
CVE-2026-41653· BentoPDF (self-hosted browser-side PDF toolbox) patched
Critical
Appsmith Table Widget Stored XSS to Admin Account Takeover — CVE-2026-30862
CVE-2026-30862 (GHSA-5hw4-whxv-6794)· Appsmith patched