WordPress plugin
Pods – Custom Content Types and Fields security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 20 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical4
- High5
- Medium11
- Low0
All Pods – Custom Content Types and Fields vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High8.8 | Authenticated (Author+) Remote Code Execution <3.3.9.1Update to 3.3.9.1 | CVE-2026-74851 | |
| Critical9.8 | Unauthenticated Privilege Escalation via Authorization Bypass to Admin Methods via 'pods_admin' AJAX Router ≤3.3.9Update to 2.8.23.4 or 2.9.19.4 or 3.0.10.4 or 3.1.4.2 or 3.2.8.3 or 3.3.9.1 | CVE-2026-19598 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤3.3.8Update to 3.3.9 | CVE-2026-54191 | |
| Critical10.0 | Injected Backdoor 4.4.6.4 – 4.4.7.1Update to 4.4.7.3 | CVE-2024-6297 | |
| High8.8 | Custom Content Types and Fields - Authenticated (Contributor+) SQL Injection via Shortcode <3.0.10.2Update to 2.7.31.2 or 2.8.23.2 or 2.9.19.2 or 3.0.10.2 | CVE-2023-6967 | |
| High8.8 | Custom Content Types and Fields - Authenticated (Contributor+) Remote Code Execution <3.0.10.2Update to 2.7.31.2 or 2.8.23.2 or 2.9.19.2 or 3.0.10.2 | CVE-2023-6999 | |
| High7.1 | Cross-Site Request Forgery ≤2.9.10.2Update to 2.9.11 | CVE-2023-23790 | |
| Critical9.8 | SQL Injection <2.5.1.2Update to 2.5.1.2 | — | |
| Critical9.6 | Multiple Cross-Site Request Forgery ≤2.4.3Update to 2.5 | CVE-2014-7957 |
- High8.8Authenticated (Author+) Remote Code Execution
<3.3.9.1Update to 3.3.9.1
- Critical9.8Unauthenticated Privilege Escalation via Authorization Bypass to Admin Methods via 'pods_admin' AJAX Router
≤3.3.9Update to 2.8.23.4 or 2.9.19.4 or 3.0.10.4 or 3.1.4.2 or 3.2.8.3 or 3.3.9.1
- High7.2Unauthenticated Stored Cross-Site Scripting
≤3.3.8Update to 3.3.9
- Critical10.0Injected Backdoor
4.4.6.4 – 4.4.7.1Update to 4.4.7.3
- High8.8Custom Content Types and Fields - Authenticated (Contributor+) SQL Injection via Shortcode
<3.0.10.2Update to 2.7.31.2 or 2.8.23.2 or 2.9.19.2 or 3.0.10.2
- High8.8Custom Content Types and Fields - Authenticated (Contributor+) Remote Code Execution
<3.0.10.2Update to 2.7.31.2 or 2.8.23.2 or 2.9.19.2 or 3.0.10.2
- High7.1Cross-Site Request Forgery
≤2.9.10.2Update to 2.9.11
- Critical9.8SQL Injection
<2.5.1.2Update to 2.5.1.2
- Critical9.6Multiple Cross-Site Request Forgery
≤2.4.3Update to 2.5
Pods – Custom Content Types and Fields: common questions
Does Pods – Custom Content Types and Fields have known vulnerabilities?
Yes. VulnCrest Radar lists 20 known vulnerabilities in Pods – Custom Content Types and Fields: 4 critical, 5 high, 11 medium. None are known to affect version null.
How do I check which version of Pods – Custom Content Types and Fields I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Pods – Custom Content Types and Fields vulnerability?
CVE-2026-76573, published Sep 4, 2026: Pods <= 3.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode Attribute. Severity: Medium (CVSS 6.4).
Is any Pods – Custom Content Types and Fields vulnerability listed in CISA KEV?
No. None of the known Pods – Custom Content Types and Fields vulnerabilities is currently listed in the CISA KEV catalog.