Pods – Custom Content Types and Fields vulnerabilities

3 known vulnerabilities in Pods – Custom Content Types and Fields from Sc0ttkclark. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Pods – Custom Content Types and Fields: Incorrect Authorization

  CVE-2026-19598Aug 15, 2026Sc0ttkclarkEPSS 3.52%

  The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The vulnerability exists because the pods_admin AJAX router funnels every access check —

• 8.8 High severity

  Pods – Custom Content Types and Fields: Improper Neutralization of Special Elements used in a Command

  CVE-2023-6999Apr 9, 2024Sc0ttkclarkEPSS 1.28%

  The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Remote Code Exxecution via shortcode in all versions up to, and including, 3.0.10 (with the exception of 2.7.31.2, 2.8.23.2, 2.9.19.2). This makes it possible for authenticated at

• 8.8 High severity

  Pods – Custom Content Types and Fields: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2023-6967Apr 9, 2024Sc0ttkclark

  The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to SQL Injection via shortcode in all versions up to, and including, 3.0.10 (with the exception of 2.7.31.2, 2.8.23.2, 2.9.19.2) due to insufficient escaping on the user supplied par