WordPress plugin
Pods – Custom Content Types and Fields security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 20 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical4
- High5
- Medium11
- Low0
All Pods – Custom Content Types and Fields vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode Attribute ≤3.3.9.1Update to 3.3.9.2 | CVE-2026-76573 | |
| Medium6.5 | 3.3.9.1 - Authenticated (Author+) Arbitrary File Read 3.3 – 3.3.9.1Update to 3.3.9.2 | CVE-2026-74853 | |
| High8.8 | Authenticated (Author+) Remote Code Execution <3.3.9.1Update to 3.3.9.1 | CVE-2026-74851 | |
| Critical9.8 | Unauthenticated Privilege Escalation via Authorization Bypass to Admin Methods via 'pods_admin' AJAX Router ≤3.3.9Update to 2.8.23.4 or 2.9.19.4 or 3.0.10.4 or 3.1.4.2 or 3.2.8.3 or 3.3.9.1 | CVE-2026-19598 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤3.3.8Update to 3.3.9 | CVE-2026-54191 | |
| Medium4.4 | Authenticated (Admin+) Stored Cross-Site Scripting ≤3.2.8.1Update to 3.2.8.2 | CVE-2025-1446 | |
| Medium4.4 | Authenticated (Admin+) Stored Cross-Site Scripting ≤3.2.8Update to 3.2.8.1 | CVE-2024-11849 | |
| Medium4.4 | Authenticated (Administrator+) Stored Cross-Site Scripting ≤3.2.7Update to 3.2.7.1 | CVE-2024-9883 | |
| Critical10.0 | Injected Backdoor 4.4.6.4 – 4.4.7.1Update to 4.4.7.3 | CVE-2024-6297 | |
| Medium5.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via Pod Form Redirect URL ≤3.2.1Update to 3.2.1.1 | CVE-2024-3956 | |
| Medium4.3 | Custom Content Types and Fields - Missing Authorization <3.0.10.2Update to 2.7.31.2 or 2.8.23.2 or 2.9.19.2 or 3.0.10.2 | CVE-2023-6965 | |
| High8.8 | Custom Content Types and Fields - Authenticated (Contributor+) SQL Injection via Shortcode <3.0.10.2Update to 2.7.31.2 or 2.8.23.2 or 2.9.19.2 or 3.0.10.2 | CVE-2023-6967 | |
| High8.8 | Custom Content Types and Fields - Authenticated (Contributor+) Remote Code Execution <3.0.10.2Update to 2.7.31.2 or 2.8.23.2 or 2.9.19.2 or 3.0.10.2 | CVE-2023-6999 | |
| High7.1 | Cross-Site Request Forgery ≤2.9.10.2Update to 2.9.11 | CVE-2023-23790 | |
| Medium5.5 | Authenticated (Admin+) Cross-Site Scripting ≤2.7.28Update to 2.7.29 | — | |
| Medium5.4 | Authenticated Stored Cross-Site Scripting via Menu Label field 2.4.4.2 – 2.7.26Update to 2.7.27 | CVE-2021-24339 | |
| Medium5.4 | 2.7.26 - Authenticated Stored Cross-Site Scripting 2.4.4.1 – <2.7.27Update to 2.7.27 | CVE-2021-24338 | |
| Critical9.8 | SQL Injection <2.5.1.2Update to 2.5.1.2 | — | |
| Critical9.6 | Multiple Cross-Site Request Forgery ≤2.4.3Update to 2.5 | CVE-2014-7957 | |
| Medium6.1 | Cross-Site Scripting ≤2.4.3Update to 2.5 | CVE-2014-7956 |
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode Attribute
≤3.3.9.1Update to 3.3.9.2
- Medium6.53.3.9.1 - Authenticated (Author+) Arbitrary File Read
3.3 – 3.3.9.1Update to 3.3.9.2
- High8.8Authenticated (Author+) Remote Code Execution
<3.3.9.1Update to 3.3.9.1
- Critical9.8Unauthenticated Privilege Escalation via Authorization Bypass to Admin Methods via 'pods_admin' AJAX Router
≤3.3.9Update to 2.8.23.4 or 2.9.19.4 or 3.0.10.4 or 3.1.4.2 or 3.2.8.3 or 3.3.9.1
- High7.2Unauthenticated Stored Cross-Site Scripting
≤3.3.8Update to 3.3.9
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤3.2.8.1Update to 3.2.8.2
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤3.2.8Update to 3.2.8.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤3.2.7Update to 3.2.7.1
- Critical10.0Injected Backdoor
4.4.6.4 – 4.4.7.1Update to 4.4.7.3
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via Pod Form Redirect URL
≤3.2.1Update to 3.2.1.1
- Medium4.3Custom Content Types and Fields - Missing Authorization
<3.0.10.2Update to 2.7.31.2 or 2.8.23.2 or 2.9.19.2 or 3.0.10.2
- High8.8Custom Content Types and Fields - Authenticated (Contributor+) SQL Injection via Shortcode
<3.0.10.2Update to 2.7.31.2 or 2.8.23.2 or 2.9.19.2 or 3.0.10.2
- High8.8Custom Content Types and Fields - Authenticated (Contributor+) Remote Code Execution
<3.0.10.2Update to 2.7.31.2 or 2.8.23.2 or 2.9.19.2 or 3.0.10.2
- High7.1Cross-Site Request Forgery
≤2.9.10.2Update to 2.9.11
- Medium5.5Authenticated (Admin+) Cross-Site Scripting
≤2.7.28Update to 2.7.29
- Medium5.4Authenticated Stored Cross-Site Scripting via Menu Label field
2.4.4.2 – 2.7.26Update to 2.7.27
- Medium5.42.7.26 - Authenticated Stored Cross-Site Scripting
2.4.4.1 – <2.7.27Update to 2.7.27
- Critical9.8SQL Injection
<2.5.1.2Update to 2.5.1.2
- Critical9.6Multiple Cross-Site Request Forgery
≤2.4.3Update to 2.5
- Medium6.1Cross-Site Scripting
≤2.4.3Update to 2.5
Pods – Custom Content Types and Fields: common questions
Does Pods – Custom Content Types and Fields have known vulnerabilities?
Yes. VulnCrest Radar lists 20 known vulnerabilities in Pods – Custom Content Types and Fields: 4 critical, 5 high, 11 medium. None are known to affect version null.
How do I check which version of Pods – Custom Content Types and Fields I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Pods – Custom Content Types and Fields vulnerability?
CVE-2026-76573, published Sep 4, 2026: Pods <= 3.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode Attribute. Severity: Medium (CVSS 6.4).
Is any Pods – Custom Content Types and Fields vulnerability listed in CISA KEV?
No. None of the known Pods – Custom Content Types and Fields vulnerabilities is currently listed in the CISA KEV catalog.