Pods – Custom Content Types and Fields

Уязвимости

• CVE-2026-19598без авторизации≤ 3.3.9

  Pods <= 3.3.9 - Unauthenticated Privilege Escalation via Authorization Bypass to Admin Methods via 'pods_admin' AJAX Router

  Критич. 9.8

• CVE-2023-23790без авторизации · нужен клик≤ 2.9.10.2

  WordPress Pods Plugin <= 2.9.10.2 is vulnerable to Cross Site Request Forgery (CSRF)

  Высокий 8.8

• CVE-2023-6999участник+→ 2.7.31

  Pods - Custom Content Types and Fields - Authenticated (Contributor+) Remote Code Execution

  Высокий 8.8

• CVE-2023-6967участник+→ 2.7.31

  Pods - Custom Content Types and Fields - Authenticated (Contributor+) SQL Injection via Shortcode

  Высокий 8.8

• CVE-2026-54191без авторизации · нужен клик≤ 3.3.8

  WordPress Pods plugin <= 3.3.8 - Cross Site Scripting (XSS) vulnerability

  Высокий 7.1

• CVE-2014-7957

  Multiple cross-site request forgery (CSRF) vulnerabilities in the Pods plugin before 2.5 for WordPress allow remote attackers to hijack the

  Средний 6.8

• CVE-2026-76573участник+≤ 3.3.9.1

  Pods <= 3.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode Attribute

  Средний 6.4

• CVE-2024-3956участник+≤ 3.2.1

  Pods – Custom Content Types and Fields <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pod Form Redirect URL

  Средний 5.4

• CVE-2023-6965участник+→ 2.7.31

  Pods - Custom Content Types and Fields - Missing Authorization

  Средний 4.3