What’s Vulnerable › Vulnerabilities

CVE-2025-1446: Pods < 3.2.8.2 - Admin+ SQL Injection

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-03-23 · updated 2026-06-17
• Weakness: CWE-89

Description

The Pods WordPress plugin before 3.2.8.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks

Affected products

• sc0ttkclark Pods – Custom Content Types and Fields: before 3.2.8.2 — fixed in 3.2.8.2

How to fix

Upgrade to a fixed version: sc0ttkclark Pods – Custom Content Types and Fields 3.2.8.2. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/c170fb45-7ed5-40ef-99f6-8da035a23d89/
• https://wpscan.com/vulnerability/c170fb45-7ed5-40ef-99f6-8da035a23d89/

Get alerted when CVE-2025-1446 or the next vulnerability affects your stack