Pods CVE-2026-54191

Exploitation requires (1) the target WordPress site to have the Pods plugin installed at version 3.3.8 or earlier, (2) the vulnerable Pods endpoint to be reachable by the unauthenticated attacker over the network (PR:N, AV:N), and (3) a victim - typically an authenticated WordPress user or administrator - to interact with attacker-controlled content such as a malicious link or page (UI:R). Limiting factors: the required user interaction means drive-by mass exploitation is not possible without successful social engineering, and the C:L/I:L/A:L impact metrics indicate the immediate damage is bounded to what script in the victim's browser session can achieve rather than direct server compromise.

CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects a network-reachable, low-complexity, unauthenticated bug whose impact depends on a victim clicking a crafted link or visiting an attacker-controlled page (UI:R). The scope-change flag elevates the practical severity because injected script can act against the WordPress admin or another security context (e.g., session hijack of a logged-in administrator). EPSS and CISA KEV status are not provided in the input - neither active exploitation nor exploitation probability can be confirmed from available data. No POC was identified; the Patchstack reference is a vulnerability database listing rather than published exploit code, so this currently looks like a credible but not-yet-weaponized XSS in a widely deployed plugin.

An attacker crafts a URL or web page containing a malicious payload that triggers the unsanitized Pods endpoint, then phishes a WordPress administrator into clicking it via email, social media, or a comment link. When the admin's browser renders the response, the injected JavaScript runs in the WordPress origin and can exfiltrate session cookies, create a rogue admin account via the REST API, or pivot to full site takeover. No public exploit identified at time of analysis, but XSS proof-of-concepts for similar Patchstack-disclosed WordPress plugins are typically trivial to reconstruct from the advisory.