CVE-2024-11849

The Pods WordPress plugin before 3.2.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-11849

The Pods WordPress plugin before 3.2.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-11849

creationtimestamp| type| source ---|---|--- 2025-01-06 06:03:26+00:00| seen| https://infosec.exchange/users/cve/statuses/113779894266060216 2025-01-06 06:15:30+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lf2ib3s42j2k 2025-01-06 06:40:36+00:00| seen|...

CVE-2024-11849 Pods – Custom Content Types and Fields < 3.2.8.1 - Admin+ Stored XSS

The Pods WordPress plugin before 3.2.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-11849

CVE-2024-11849 — Pods (WordPress) vulnerable to authenticated Stored XSS due to unsanitized/escaped settings in Pods Custom Content Types and Fields. Affected: Pods plugin for WordPress (prior to or up to 3.2.8) in admin contexts. Impact: high-privilege users (e.g., admins) can inject scripts via...