Plugin icon

Pods – Custom Content Types and Fields

pods

Vulnerabilities:

24

Last Updated:

August 31, 2026

Active Installs:

100000

Published
Title
Fixed in
CVSS
Published
2026-09-04
Title
Pods < 3.3.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode Attribute
Fixed in
Fixed in 3.3.9.2
CVSS
5.5 (medium)
Published
2026-09-02
Title
Pods < 3.3.9.2 - Author+ Arbitrary File Read via Shortcode Display Callback
Fixed in
Fixed in 3.3.9.2
CVSS
6.8 (medium)
Published
2026-08-24
Title
Pods < 3.3.9.1 - Author+ RCE via Shortcode Display Callback
Fixed in
Fixed in 3.3.9.1
CVSS
7.2 (high)
Published
2026-08-15
Title
Pods < 3.3.9.1 - Unauthenticated Privilege Escalation via 'pods_admin' AJAX Router
Fixed in
Fixed in 2.8.23.4
CVSS
9.8 (critical)
Published
2026-08-15
Title
Pods < 3.3.9.1 - Unauthenticated Privilege Escalation via 'pods_admin' AJAX Router
Fixed in
Fixed in 3.3.9.1
CVSS
9.8 (critical)
Published
2026-08-15
Title
Pods < 3.3.9.1 - Unauthenticated Privilege Escalation via 'pods_admin' AJAX Router
Fixed in
Fixed in 3.1.4.2
CVSS
9.8 (critical)
Published
2026-08-15
Title
Pods < 3.3.9.1 - Unauthenticated Privilege Escalation via 'pods_admin' AJAX Router
Fixed in
Fixed in 2.9.19.4
CVSS
9.8 (critical)
Published
2026-08-15
Title
Pods < 3.3.9.1 - Unauthenticated Privilege Escalation via 'pods_admin' AJAX Router
Fixed in
Fixed in 3.2.8.3
CVSS
9.8 (critical)
Published
2026-08-15
Title
Pods < 3.3.9.1 - Unauthenticated Privilege Escalation via 'pods_admin' AJAX Router
Fixed in
Fixed in 3.0.10.4
CVSS
9.8 (critical)
Published
2026-06-15
Title
Pods – Custom Content Types and Fields < 3.3.9 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 3.3.9
CVSS
7.2 (high)
Published
2025-03-02
Title
Pods < 3.2.8.2 - Admin+ SQL Injection
Fixed in
Fixed in 3.2.8.2
CVSS
4.1 (medium)
Published
2024-12-16
Title
Pods – Custom Content Types and Fields < 3.2.8.1 - Admin+ Stored XSS
Fixed in
Fixed in 3.2.8.1
CVSS
3.5 (low)
Published
2024-10-15
Title
Pods < 3.2.7.1 - Admin+ Stored XSS
Fixed in
Fixed in 3.2.7.1
CVSS
3.5 (low)
Published
2024-05-09
Title
Pods – Custom Content Types and Fields < 3.2.1.1 - Contributor+ Stored Cross-Site Scripting via Pod Form Redirect URL
Fixed in
Fixed in 3.2.1.1
CVSS
5.4 (medium)
Published
2024-03-28
Title
Pods < 3.1 - Contributor+ Pods/Users Creation
Fixed in
Fixed in 3.1
CVSS
4.3 (medium)
Published
2024-03-28
Title
Pods < 3.1 - Contributor+ SQLi
Fixed in
Fixed in 3.1
CVSS
6.8 (medium)
Published
2024-03-28
Title
Pods < 3.1 - Contributor+ Remote Code Execution
Fixed in
Fixed in 3.1
CVSS
7.2 (high)
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Fixed in
Fixed in 2.8.0
CVSS
6.1 (medium)
Published
2023-01-20
Title
Pods < 2.9.11 - Pods Deletion via CSRF
Fixed in
Fixed in 2.9.11
CVSS
4.3 (medium)
Published
2021-08-06
Title
Pods < 2.7.29 - Multiple Authenticated Stored Cross-Site Scripting (XSS)
Fixed in
Fixed in 2.7.29
CVSS
2.7 (low)
Published
2021-01-15
Title
Pods < 2.7.27 - Authenticated Stored Cross-Site Scripting (XSS)
Fixed in
Fixed in 2.7.27
CVSS
4.8 (medium)
Published
2021-01-15
Title
Pods < 2.7.27 - Authenticated Stored Cross-Site Scripting (XSS)
Fixed in
Fixed in 2.7.27
CVSS
4.8 (medium)
Published
2015-03-16
Title
Pods 1.4.7 <= 2.5.1.1 - Blind SQL Injection
Fixed in
Fixed in 2.5.1.2
CVSS
n/a
Published
2015-01-12
Title
Pods < 2.5 - Authenticated XSS & CSRF
Fixed in
Fixed in 2.5
CVSS
n/a