https://poc.intelseclab.com/tags/xss/Latest proof-of-concept entries.Hugoen-usSun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2026-64638-wordpress-xss2shell-pre-auth-xss-to-rce/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2026-64638-wordpress-xss2shell-pre-auth-xss-to-rce/High severity (CVSS 8.9) — web · CVE-2026-64638. Status: Patched. Affects: WordPress Core, wp-login.php failed-login error message, KSES sanitizer vs PHP strip_tags(). Tags: wordpress, wordpress-core, pre-auth, xss, reflected-xss, xss2shell, rce, parser-differential, dom-clobbering, some, jsonp, rest-api, application-password, plugin-upload, CWE-79, CWE-94, cms.webHighwordpresswordpress-corepre-authxssreflected-xssxss2shellrceparser-differentialdom-clobberingsomejsonprest-apiapplication-passwordplugin-uploadCWE-79CWE-94cmshttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0594-listsitecontributors-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0594-listsitecontributors-xss/Medium severity — web · CVE-2026-0594. Status: PoC. Affects: "List Site Contributors" WordPress plugin. Tags: wordpress, xss, reflected-xss, wp-json, rest-api, plugin-vulnerability, golang, scanner.webMediumwordpressxssreflected-xsswp-jsonrest-apiplugin-vulnerabilitygolangscannerhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-21876-crs-waf-multipart-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-21876-crs-waf-multipart-bypass/Critical severity — web · CVE-2026-21876. Status: PoC. Tags: waf-bypass, owasp-crs, modsecurity, multipart-form-data, charset-smuggling, xss, docker-lab.webCriticalwaf-bypassowasp-crsmodsecuritymultipart-form-datacharset-smugglingxssdocker-labhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33331-orpc-openapi-stored-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33331-orpc-openapi-stored-xss/High severity — web · CVE-2026-33331 (GHSA-7f6v-3gx7-27q8). Status: PoC. Affects: middleapi/orpc — OpenAPI documentation reference plugin (packages/openapi/src/plugins/openapi-reference.ts). Tags: xss, stored-xss, orpc, openapi, cwe-79, javascript, nodejs, docs-page.webHighxssstored-xssorpcopenapicwe-79javascriptnodejsdocs-pagehttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24415-openstamanager-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24415-openstamanager-xss/Medium severity — web · CVE-2026-24415 (GHSA-jfgp-g7x7-j25j). Status: PoC. Affects: OpenSTAManager (devcode-it/openstamanager). Tags: xss, reflected-xss, openstamanager, cwe-79, session-hijacking, php, unauthenticated-payload.webMediumxssreflected-xssopenstamanagercwe-79session-hijackingphpunauthenticated-payloadhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3228-nextscripts-wp-stored-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3228-nextscripts-wp-stored-xss/Medium severity (CVSS 6.4) — web · CVE-2026-3228. Status: PoC. Affects: NextScripts: Social Networks Auto-Poster (WordPress plugin). Tags: wordpress, xss, stored-xss, plugin, contributor-privilege, shortcode, session-hijacking.webMediumwordpressxssstored-xssplugincontributor-privilegeshortcodesession-hijackinghttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4406-gravity-forms-reflected-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4406-gravity-forms-reflected-xss/Medium severity (CVSS 6.1) — web · CVE-2026-4406. Status: PoC. Affects: Gravity Forms (WordPress plugin) by Rocketgenius, Inc.. Tags: wordpress, gravity-forms, xss, reflected-xss, admin-ajax, unauthenticated, cwe-79.webMediumwordpressgravity-formsxssreflected-xssadmin-ajaxunauthenticatedcwe-79https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-41653-bentopdf-stored-xss-exfil/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-41653-bentopdf-stored-xss-exfil/Critical severity — web · CVE-2026-41653. Status: PoC. Affects: BentoPDF (self-hosted browser-side PDF toolbox). Tags: xss, stored-xss, file-exfiltration, client-side, service-worker, wasm-hijack, pdf-toolbox, markdown-injection.webCriticalxssstored-xssfile-exfiltrationclient-sideservice-workerwasm-hijackpdf-toolboxmarkdown-injectionhttps://poc.intelseclab.com/pocs/web/2026-06-08_firefox-focus-ios-uxss-redirect-scheme-race-condition/Mon, 08 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-06-08_firefox-focus-ios-uxss-redirect-scheme-race-condition/Critical severity (CVSS 9.3) — web. Status: Unpatched. Affects: Firefox Focus for iOS. Tags: UXSS, XSS, race-condition, TOCTOU, redirect-validation, javascript-scheme, iOS, Firefox Focus.webCriticalUXSSXSSrace-conditionTOCTOUredirect-validationjavascript-schemeiOSFirefox Focushttps://poc.intelseclab.com/pocs/web/2026-05-17_nextjs-csp-nonce-cache-poisoned-xss/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-17_nextjs-csp-nonce-cache-poisoned-xss/Medium severity (CVSS 4.7) — web · CVE-2026-44581. Status: Weaponized. Affects: Next.js App Router applications using CSP nonces. Tags: XSS, cache-poisoning, CSP-nonce, Next.js, App-Router, unauthenticated.webMediumXSScache-poisoningCSP-nonceNext.jsApp-Routerunauthenticatedhttps://poc.intelseclab.com/pocs/web/2026-05-17_nextjs-beforeinteractive-script-xss/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-17_nextjs-beforeinteractive-script-xss/Medium severity (CVSS 6.1) — web · CVE-2026-44580. Status: Weaponized. Affects: Next.js applications using next/script with strategy="beforeInteractive". Tags: XSS, next/script, beforeInteractive, Next.js, App-Router, unauthenticated.webMediumXSSnext/scriptbeforeInteractiveNext.jsApp-Routerunauthenticated