Executive brief
Pods is a popular WordPress plugin that enables creation of custom content types and custom fields. The plugin contains a vulnerability in shortcode handling that allows authenticated users (with contributor role or higher) to inject malicious scripts into pages. When other users view these pages, the injected scripts execute in their browsers, potentially compromising account security or data integrity.
Technical details
The vulnerability is a stored Cross-Site Scripting (XSS) flaw in the shortcode processor, specifically in handling of the 'not_found' shortcode attribute. The plugin fails to properly sanitize user input in this attribute before storing it in the database, and does not adequately escape the output when rendering the shortcode. This allows authenticated attackers with contributor-level access or above to inject arbitrary JavaScript. The injected script persists in the database and executes in the browsers of any user who views the affected page. No special privileges or user interaction beyond normal page viewing is required for exploitation to succeed.
Affected products
- Pods Custom Content Types and Fields up to and including 3.3.9.1
Timeline
- 2026-09-05: disclosed