What’s Vulnerable › Products
sc0ttkclark Pods – Custom Content Types and Fields vulnerabilities
15 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.
Check whether your sc0ttkclark Pods – Custom Content Types and Fields version is affected
Latest sc0ttkclark Pods – Custom Content Types and Fields vulnerabilities
- CVE-2026-76573 — Pods <= 3.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode Attribute (CVSS 6.4)
- CVE-2026-74853 — Pods < 3.3.9.2 - Author+ Arbitrary File Read via Shortcode Display Callback (CVSS 6.8)
- CVE-2026-74851 — Pods < 3.3.9.1 - Author+ RCE via Shortcode Display Callback (CVSS 7.2)
- CVE-2026-19598 — Pods <= 3.3.9 - Unauthenticated Privilege Escalation via Authorization Bypass to Admin Methods via 'pods_admin' AJAX Router (CVSS 9.8)
- CVE-2025-1446 — Pods < 3.2.8.2 - Admin+ SQL Injection (CVSS 9.8)
- CVE-2024-11849 — Pods – Custom Content Types and Fields < 3.2.8.1 - Admin+ Stored XSS (CVSS 6.1)
- CVE-2024-9883 — Pods < 3.2.7.1 - Admin+ Stored XSS (CVSS 4.8)
- CVE-2024-3956 — Pods – Custom Content Types and Fields <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pod Form Redirect URL (CVSS 5.4)
- CVE-2023-6999 — Pods - Custom Content Types and Fields - Authenticated (Contributor+) Remote Code Execution (CVSS 8.8)
- CVE-2023-6967 — Pods - Custom Content Types and Fields - Authenticated (Contributor+) SQL Injection via Shortcode (CVSS 8.8)
- CVE-2023-6965 — Pods - Custom Content Types and Fields - Missing Authorization (CVSS 4.3)
- CVE-2023-23790 — WordPress Pods Plugin <= 2.9.10.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 8.8)
- CVE-2021-24339 — Pods < 2.7.27 - Authenticated Stored Cross-Site Scripting (XSS) (CVSS 5.4)
- CVE-2021-24338 — Pods < 2.7.27 - Authenticated Stored Cross-Site Scripting (XSS) (CVSS 5.4)
- CVE-2014-7956 — (CVSS 4.3)