https://poc.intelseclab.com/tags/stored-xss/Latest proof-of-concept entries.Hugoen-usSun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-40791-wp-time-slots-booking-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-40791-wp-time-slots-booking-xss/High severity (CVSS 7.2) — web · CVE-2026-40791. Status: PoC. Affects: WP Time Slots Booking Form (wp-time-slots-booking-form WordPress plugin). Tags: wordpress, wordpress-plugin, stored-xss, unauthenticated, cwe-79, admin-takeover, booking-form.webHighwordpresswordpress-pluginstored-xssunauthenticatedcwe-79admin-takeoverbooking-formhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5615-vvvebjs-svg-stored-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5615-vvvebjs-svg-stored-xss/High severity (CVSS 8.5) — web · CVE-2026-5615. Status: PoC. Affects: VvvebJs (drag-and-drop website builder). Tags: vvvebjs, stored-xss, svg-upload, file-upload, cms.webHighvvvebjsstored-xsssvg-uploadfile-uploadcmshttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27621-typicms-svg-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27621-typicms-svg-xss/Medium severity — web · CVE-2026-27621 (GHSA-xfvg-8v67-j7wp). Status: PoC. Affects: TypiCMS Core (typicms/core). Tags: typicms, stored-xss, svg-upload, cwe-79, cms, file-upload, laravel, session-hijack.webMediumtypicmsstored-xsssvg-uploadcwe-79cmsfile-uploadlaravelsession-hijackhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-22804-termix-stored-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-22804-termix-stored-xss/High severity — web · CVE-2026-22804 (GHSA-m3cv-5hgp-hv35). Status: Weaponized. Affects: Termix (Electron-based SSH/terminal manager), File Manager component (FileViewer.tsx). Tags: termix, electron, stored-xss, svg-injection, session-hijacking, lfi, file-manager, ssh.webHightermixelectronstored-xsssvg-injectionsession-hijackinglfifile-managersshhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-23499-saleor-file-upload-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-23499-saleor-file-upload-xss/High severity — web · CVE-2026-23499. Status: PoC. Affects: Saleor (saleor/saleor). Tags: saleor, stored-xss, unrestricted-file-upload, svg-xss, session-hijack, graphql, javascript.webHighsaleorstored-xssunrestricted-file-uploadsvg-xsssession-hijackgraphqljavascripthttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-22849-saleor-richtext-stored-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-22849-saleor-richtext-stored-xss/High severity — web · CVE-2026-22849 (GHSA-8jcj-r5g2-qrpv). Status: PoC. Affects: Saleor (open-source e-commerce platform), rich text fields (EditorJS content on pages/products). Tags: saleor, stored-xss, editorjs, graphql, ecommerce, session-hijacking, cwe-79.webHighsaleorstored-xsseditorjsgraphqlecommercesession-hijackingcwe-79https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-40487-postiz-svg-upload-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-40487-postiz-svg-upload-xss/High severity (CVSS 8.9) — web · CVE-2026-40487 / GHSA-44wg-r34q-hvfx. Status: PoC. Affects: Postiz (open-source social media management platform, gitroomhq/postiz-app). Tags: file-upload, mime-spoofing, stored-xss, account-takeover, postiz, nodejs, oauth-backdoor.webHighfile-uploadmime-spoofingstored-xssaccount-takeoverpostiznodejsoauth-backdoorhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33331-orpc-openapi-stored-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33331-orpc-openapi-stored-xss/High severity — web · CVE-2026-33331 (GHSA-7f6v-3gx7-27q8). Status: PoC. Affects: middleapi/orpc — OpenAPI documentation reference plugin (packages/openapi/src/plugins/openapi-reference.ts). Tags: xss, stored-xss, orpc, openapi, cwe-79, javascript, nodejs, docs-page.webHighxssstored-xssorpcopenapicwe-79javascriptnodejsdocs-pagehttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3228-nextscripts-wp-stored-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3228-nextscripts-wp-stored-xss/Medium severity (CVSS 6.4) — web · CVE-2026-3228. Status: PoC. Affects: NextScripts: Social Networks Auto-Poster (WordPress plugin). Tags: wordpress, xss, stored-xss, plugin, contributor-privilege, shortcode, session-hijacking.webMediumwordpressxssstored-xssplugincontributor-privilegeshortcodesession-hijackinghttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-35455-immich-exfiltration/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-35455-immich-exfiltration/High severity — web · CVE-2026-35455. Status: Weaponized. Affects: Immich (self-hosted photo/video management). Tags: immich, stored-xss, exfiltration, api-key-theft, account-hijacking, self-hosted-photos, c2.webHighimmichstored-xssexfiltrationapi-key-theftaccount-hijackingself-hosted-photosc2https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33657-espocrm-stored-html-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33657-espocrm-stored-html-injection/Medium severity — web · CVE-2026-33657. Status: PoC. Affects: EspoCRM 9.3.3. Tags: espocrm, html-injection, stored-xss, cwe-80, email-notifications, authenticated, crm, template-injection.webMediumespocrmhtml-injectionstored-xsscwe-80email-notificationsauthenticatedcrmtemplate-injectionhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-2600-elementskit-stored-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-2600-elementskit-stored-xss/Medium severity (CVSS 6.4) — web · CVE-2026-2600. Status: Weaponized. Affects: ElementsKit Elementor Addons (WordPress plugin). Tags: wordpress, elementor, stored-xss, rest-api, privilege-escalation, contributor, plugin, cwe-79.webMediumwordpresselementorstored-xssrest-apiprivilege-escalationcontributorplugincwe-79https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5513-bookly-cookie-stored-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5513-bookly-cookie-stored-xss/High severity (CVSS 7.2) — web · CVE-2026-5513. Status: PoC. Affects: Bookly — Online Scheduling and Appointment Booking System (WordPress plugin). Tags: wordpress, bookly, stored-xss, cwe-79, cookie-injection, appointment-booking.webHighwordpressbooklystored-xsscwe-79cookie-injectionappointment-bookinghttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-41653-bentopdf-stored-xss-exfil/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-41653-bentopdf-stored-xss-exfil/Critical severity — web · CVE-2026-41653. Status: PoC. Affects: BentoPDF (self-hosted browser-side PDF toolbox). Tags: xss, stored-xss, file-exfiltration, client-side, service-worker, wasm-hijack, pdf-toolbox, markdown-injection.webCriticalxssstored-xssfile-exfiltrationclient-sideservice-workerwasm-hijackpdf-toolboxmarkdown-injectionhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-30862-appsmith-stored-xss-privesc/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-30862-appsmith-stored-xss-privesc/Critical severity (CVSS 9.1) — web · CVE-2026-30862 (GHSA-5hw4-whxv-6794). Status: PoC. Affects: Appsmith. Tags: appsmith, stored-xss, csrf, privilege-escalation, xsrf-token, react, low-code.webCriticalappsmithstored-xsscsrfprivilege-escalationxsrf-tokenreactlow-code