VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 14 known issues Latest disclosed Mar 02, 2025

Pods – Custom Content Types and Fields Vulnerabilities

Review known vulnerability records for the WordPress plugin Pods – Custom Content Types and Fields (`pods`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2025-1446, CVE-2024-11849 and CVE-2024-9883, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
14
High or Critical
5
Patch Coverage
100%
Last Updated
Apr 07, 2025
Priority CVE Quick Links

Fast paths into Pods – Custom Content Types and Fields CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
12
CVE-2014-7957 Critical 2.5
CVE-2014-7957 Pods – Custom Content Types and Fields Cross-Site Scripting

Pods <= 2.4.3 - Multiple Cross-Site Request Forgery

CVE-2023-6999 High 2.7.31.2
CVE-2023-6999 Pods – Custom Content Types and Fields Remote Code Execution

Pods - Custom Content Types and Fields - Authenticated (Contributor+) Remote Code Execution

CVE-2023-6967 High 2.7.31.2
CVE-2023-6967 Pods – Custom Content Types and Fields SQL Injection

Pods - Custom Content Types and Fields - Authenticated (Contributor+) SQL Injection via Shortcode

CVE-2023-23790 High 2.9.11
CVE-2023-23790 Pods – Custom Content Types and Fields Cross-Site Request Forgery

Pods <= 2.9.10.2 - Cross-Site Request Forgery

CVE-2014-7956 Medium 2.5
CVE-2014-7956 Pods – Custom Content Types and Fields Cross-Site Scripting

Pods <= 2.4.3 - Cross-Site Scripting

CVE-2024-3956 Medium 3.2.1.1
CVE-2024-3956 Pods – Custom Content Types and Fields Stored Cross-Site Scripting

Pods – Custom Content Types and Fields <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pod Form Redirect URL

CVE-2021-24338 Medium 2.7.27
CVE-2021-24338 Pods – Custom Content Types and Fields Stored Cross-Site Scripting

Pods 2.4.4.1 - 2.7.26 - Authenticated Stored Cross-Site Scripting

CVE-2021-24339 Medium 2.7.27
CVE-2021-24339 Pods – Custom Content Types and Fields Stored Cross-Site Scripting

Pods <= 2.7.26 - Authenticated Stored Cross-Site Scripting via Menu Label field

Coverage Snapshot

What this page helps you verify fast

This hub clusters every indexed record for Pods – Custom Content Types and Fields so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
14 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
2 critical and 3 high severity findings.
Recent CVEs
CVE-2025-1446, CVE-2024-11849 and CVE-2024-9883
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

Known Vulnerabilities

Reports for Pods – Custom Content Types and Fields

Sorted by latest disclosure date so newly published issues surface first.

Plugin Medium Patched: Yes CVE-2025-1446
CVE-2025-1446: Pods – Custom Content Types and Fields <= 3.2.8.1 - Authenticated (Admin+) Stored Cross-Site Scripting

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.2.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attac...

Published
Mar 02, 2025
Patched Release
3.2.8.2
Affected Versions
Versions up to 3.2.8.1
Next Step
Update to 3.2.8.2 or newer if supported.
Open CVE-2025-1446 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-11849
CVE-2024-11849: Pods – Custom Content Types and Fields <= 3.2.8 - Authenticated (Admin+) Stored Cross-Site Scripting

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacke...

Published
Dec 16, 2024
Patched Release
3.2.8.1
Affected Versions
Versions up to 3.2.8
Next Step
Update to 3.2.8.1 or newer if supported.
Open CVE-2024-11849 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-9883
CVE-2024-9883: Pods <= 3.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacke...

Published
Oct 15, 2024
Patched Release
3.2.7.1
Affected Versions
Versions up to 3.2.7
Next Step
Update to 3.2.7.1 or newer if supported.
Open CVE-2024-9883 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-3956
CVE-2024-3956: Pods – Custom Content Types and Fields <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pod Form Redirect URL

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Pod Form widget in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it p...

Published
May 09, 2024
Patched Release
3.2.1.1
Affected Versions
Versions up to 3.2.1
Next Step
Update to 3.2.1.1 or newer if supported.
Open CVE-2024-3956 Report Open CVE Reference
Plugin High Patched: Yes CVE-2023-6999
CVE-2023-6999: Pods - Custom Content Types and Fields - Authenticated (Contributor+) Remote Code Execution

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Remote Code Exxecution via shortcode in all versions up to, and including, 3.0.10 (with the exception of 2.7.31.2, 2.8.23.2, 2.9.19.2). This makes it possible for authenticated attackers, with contri...

Published
Mar 28, 2024
Patched Release
2.7.31.2
Affected Versions
Versions before 2.7.31
Next Step
Update to 2.7.31.2 or newer if supported.
Open CVE-2023-6999 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-6965
CVE-2023-6965: Pods - Custom Content Types and Fields - Missing Authorization

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0.10 (with the exception of 2.7.31.2, 2.8.23.2, 2.9.19.2). This is due to the fact that the plugin allows the use of a file inclusion fea...

Published
Mar 28, 2024
Patched Release
2.7.31.2
Affected Versions
Versions before 2.7.31
Next Step
Update to 2.7.31.2 or newer if supported.
Open CVE-2023-6965 Report Open CVE Reference
Plugin High Patched: Yes CVE-2023-6967
CVE-2023-6967: Pods - Custom Content Types and Fields - Authenticated (Contributor+) SQL Injection via Shortcode

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to SQL Injection via shortcode in all versions up to, and including, 3.0.10 (with the exception of 2.7.31.2, 2.8.23.2, 2.9.19.2) due to insufficient escaping on the user supplied parameter and lack of s...

Published
Mar 28, 2024
Patched Release
2.7.31.2
Affected Versions
Versions before 2.7.31
Next Step
Update to 2.7.31.2 or newer if supported.
Open CVE-2023-6967 Report Open CVE Reference
Plugin High Patched: Yes CVE-2023-23790
CVE-2023-23790: Pods <= 2.9.10.2 - Cross-Site Request Forgery

The Pods plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.9.10.2. This is due to missing or incorrect nonce validation when deleting pods. This makes it possible for unauthenticated attackers to delete pods via forged request gr...

Published
Jan 20, 2023
Patched Release
2.9.11
Affected Versions
Versions up to 2.9.10.2
Next Step
Update to 2.9.11 or newer if supported.
Open CVE-2023-23790 Report Open CVE Reference
Plugin Medium Patched: Yes
Pods – Custom Content Types and Fields <= 2.7.28 - Authenticated (Admin+) Cross-Site Scripting

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 2.7.28 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attack...

Published
Aug 06, 2021
Patched Release
2.7.29
Affected Versions
Versions up to 2.7.28
Next Step
Update to 2.7.29 or newer if supported.
Open Full Report
Plugin Medium Patched: Yes CVE-2021-24338
CVE-2021-24338: Pods 2.4.4.1 - 2.7.26 - Authenticated Stored Cross-Site Scripting

The Pods – Custom Content Types and Fields WordPress plugin before 2.7.27 was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Singular Label' field parameter.

Published
Jan 15, 2021
Patched Release
2.7.27
Affected Versions
2.4.4.1 up to before 2.7.27
Next Step
Update to 2.7.27 or newer if supported.
Open CVE-2021-24338 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2021-24339
CVE-2021-24339: Pods <= 2.7.26 - Authenticated Stored Cross-Site Scripting via Menu Label field

The Pods – Custom Content Types and Fields WordPress plugin before 2.7.27 was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Menu Label' field parameter.

Published
Jan 15, 2021
Patched Release
2.7.27
Affected Versions
2.4.4.2 through 2.7.26
Next Step
Update to 2.7.27 or newer if supported.
Open CVE-2021-24339 Report Open CVE Reference
Plugin Critical Patched: Yes
Pods – Custom Content Types and Fields < 2.5.1.2 - SQL Injection

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to SQL Injection via the ‘orderby’ parameter in versions before 2.5.1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This mak...

Published
Mar 16, 2015
Patched Release
2.5.1.2
Affected Versions
Versions before 2.5.1.2
Next Step
Update to 2.5.1.2 or newer if supported.
Open Full Report