CVE-2026-19598

🚨 CVE-2026-19598 https://plugins.trac.wordpress.org/browser/pods/tags/3.3.9/includes/general.phpL400 WordPress 的 Pods – Custom Content Types and Fields（自定义内容类型和字段）插件在所有版本（含 3.3.9）中均存在通过授权绕过实现权限提升的漏洞。该漏洞的产生原因是：podsadmin AJAX 路由器将包括方法白名单、nonce 验证、登录强制和权限门控在内的所有访问检查，全部经由 podserror 处理，而在 JSON...

CVE-2026-74853

The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are...

CVE-2026-74853 Pods < 3.3.9.2 - Author+ Arbitrary File Read via Shortcode Display Callback

The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are...

EUVD-2026-70903

The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are...

CVE-2026-74851

The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its list of blocked functions, allowing users with the author role and above to execute arbitrary code on the server. Only sites using the restricted display-callback mode are affected, which is the...

EUVD-2026-66277

The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its list of blocked functions, allowing users with the author role and above to execute arbitrary code on the server. Only sites using the restricted display-callback mode are affected, which is the...

EUVD-2025-8026

Malicious code in bioql PyPI...

CVE-2024-11849

The Pods WordPress plugin before 3.2.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2025-1446

The Pods WordPress plugin before 3.2.8.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...

CVE-2025-1446

The Pods WordPress plugin before 3.2.8.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...

CVE-2024-9883

The CVE-2024-9883 entry concerns the Pods WordPress plugin, prior to version 3.2.7.1, where certain settings were not properly sanitized or escaped. This can allow high-privilege users (e.g., administrators) to perform Stored Cross-Site Scripting (Stored XSS), even when unfiltered_html is disallo...

CVE-2023-6999 Pods - Custom Content Types and Fields - Authenticated (Contributor+) Remote Code Execution

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Remote Code Exxecution via shortcode in all versions up to, and including, 3.0.10 with the exception of 2.7.31.2, 2.8.23.2, 2.9.19.2. This makes it possible for authenticated attackers, with contributor level access ...

CVE-2021-24339

The Pods – Custom Content Types and Fields WordPress plugin before 2.7.27 was vulnerable to an Authenticated Stored Cross-Site Scripting XSS security vulnerability within the 'Menu Label' field parameter...