What is the CVSS score of CVE-2026-54191?

CVE-2026-54191 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of Pods are affected by CVE-2026-54191?

The Pods WordPress plugin (versions 3.3.8 and earlier) contains an unauthenticated cross-site scripting vulnerability that allows remote attackers to inject arbitrary scripts into affected WordPress…

How to fix or mitigate CVE-2026-54191?

Within 24 hours: Identify all WordPress installations running Pods plugin ≤3.3.8; assess whether plugin functionality is critical to operations; disable or isolate the plugin if not essential. Within 7 days: Monitor the Pods GitHub repository and vendor security advisories for patch release; conduct forensic review of WordPress admin access logs for exploitation indicators; audit administrative user accounts for unauthorized modifications. Within 30 days: Implement Web Application Firewall rules targeting XSS injection patterns; evaluate alternative plugins or replacement solutions if patching timeline extends beyond acceptable risk window.

Pods CVE-2026-54191

EUVD-2026-37053 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-16 Patchstack

GHSA-c45f-2556-9gh3

XSS Pods

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-reachable unauthenticated XSS (PR:N, AV:N, AC:L) requiring victim click (UI:R); injected script crosses into the WordPress admin context (S:C) with limited C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 10:22 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Pods <= 3.3.8 versions.

AnalysisAI

Unauthenticated reflected/stored cross-site scripting in the Pods WordPress plugin (versions 3.3.8 and earlier) allows remote attackers to inject malicious script that executes in a victim's browser when they visit a crafted page or link. The flaw requires user interaction (UI:R) and carries a scope change (S:C), letting injected payloads steal session data or perform privileged actions in the WordPress admin context. No public exploit identified at time of analysis, but the unauthenticated nature and broad WordPress plugin install base make this a meaningful risk for site operators.

Technical ContextAI

Pods is a popular WordPress content-development framework (cpe:2.3:a:pods_framework:pods) used to create and extend custom content types, fields, and taxonomies. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controllable input is reflected or stored without proper output encoding or input sanitization. Because the vector is network-reachable and requires no authentication, the unsanitized sink is exposed on a public-facing endpoint of the plugin, allowing attacker-supplied script to be rendered in a victim's browser session against the WordPress origin.

RemediationAI

Upgrade the Pods plugin to a version newer than 3.3.8 once a fixed release is published by the maintainers - patch status in the supplied data is unclear, so this should be characterized as 'Upstream fix availability not independently confirmed; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/pods/vulnerability/wordpress-pods-plugin-3-3-8-cross-site-scripting-xss-vulnerability for the current fixed version.' In the interim, deploy a WAF rule (Patchstack, Wordfence, or equivalent) to filter XSS payloads targeting Pods endpoints, restrict access to the affected plugin pages via IP allow-listing where feasible (side effect: blocks legitimate remote contributors), enforce strict Content Security Policy headers on the WordPress site to reduce script execution impact (side effect: may break inline scripts in themes), and require administrators to log out of WordPress before browsing untrusted links.