WordPress Plugin Vulnerabilities

Pods – Custom Content Types and Fields < 3.3.9 - Unauthenticated Stored Cross-Site Scripting

Description

The plugin does not sanitise and escape some input before outputting it back in pages, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
pods
Fixed in 3.3.9

References

CVE
CVE-2026-54191
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/a57d218c-0aee-4764-9496-065e71448a9b

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.2 (high)

Miscellaneous

Original Researcher
Bonds
Verified
No
WPVDB ID
fd95d1f0-fb1c-46d9-b954-215038ed7a66

Timeline

Publicly Published
2026-06-15 (about 4 months ago)
Added
2026-06-23 (about 3 months ago)
Last Updated
2026-06-23 (about 3 months ago)

Other

Published
Title
Published
2023-02-02
Title
Embed PDF <= 1.0.6 - Contributor+ Stored XSS via Shortcode
Published
2026-03-06
Title
MyQtip – easy qTip2 <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published
2026-03-20
Title
Molla - eCommerce HTML5 Template < 1.5.19 - Reflected Cross-Site Scripting
Published
2023-11-17
Title
wpDiscuz < 7.6.13 - Admin+ Stored XSS
Published
2025-02-18
Title
Visualizer: Tables and Charts Manager for WordPress < 3.11.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Import Data From File