CVE-2026-76573

MediumCVSS 6.4

Published: 05/09/2026(UTC)Updated: 08/09/2026(UTC)Translated: 05/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'not_found' Shortcode Attribute in all versions up to, and including, 3.3.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Risk Assessment

The risk includes session hijacking, data theft, and malware propagation, potentially leading to full site compromise.

Recommendation

Update the Pods plugin to the latest version that includes security fixes. Additionally, restrict contributor permissions and regularly audit content for malicious scripts.

Other vulnerabilities in Pods – Custom Content Types and Fields

CVE-2026-19598Critical
The Pods – Custom Content Types and Fields plugin for WordPress up to version 3.3.9 contains a privilege escalation vulnerability via authorization bypass. The pods_admin AJAX router funnels all access checks through pods_error(), which in the JSON meta-box-loader compatibility path only logs failures and returns false instead of terminating the request, rendering all guards ineffective. Unauthenticated attackers can escalate privileges to Administrator or overwrite any user's password, including the site owner's, enabling complete site takeover.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS