I removed all plugins, recreated a default level server. then tested potions, poisonous potatoes, witches. Which all seemed fine, but cave spiders simply don't poison the player.