Pods Custom Content Types And Fields
Monthly
Stored Cross-Site Scripting in the Pods - Custom Content Types and Fields WordPress plugin (all versions ≤ 3.3.9.1) allows contributor-level authenticated attackers to inject persistent malicious scripts via the 'not_found' shortcode attribute, executing in victim browsers on page load. The root cause is insufficient sanitization and output escaping in general.php (lines 1399, 2535, 2539) and PodsInit.php (line 514), as identified by Wordfence. No public exploit or KEV listing has been identified at time of analysis, but the contributor-level access bar is low on multi-author WordPress sites.
Stored Cross-Site Scripting in the Pods - Custom Content Types and Fields WordPress plugin (all versions ≤ 3.3.9.1) allows contributor-level authenticated attackers to inject persistent malicious scripts via the 'not_found' shortcode attribute, executing in victim browsers on page load. The root cause is insufficient sanitization and output escaping in general.php (lines 1399, 2535, 2539) and PodsInit.php (line 514), as identified by Wordfence. No public exploit or KEV listing has been identified at time of analysis, but the contributor-level access bar is low on multi-author WordPress sites.