Description

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'not_found' Shortcode Attribute in all versions up to, and including, 3.3.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-05T09:16:50.010Z",
  "pubdate": "2026-09-05T09:16:50.010Z",
  "executiveSummary": "The Pods – Custom Content Types and Fields plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability.\nThis flaw, existing in all versions up to and including 3.3.9.1, allows authenticated users with contributor-level permissions or higher to inject malicious JavaScript payloads.\nThe vulnerability originates from the improper sanitization and output escaping of the 'not_found' shortcode attribute.\nSuccessful exploitation enables an attacker to execute arbitrary web scripts within the context of a victim's browser session whenever the compromised page is accessed.\nThe impact includes potential session hijacking, unauthorized actions performed on behalf of authenticated administrators, and the redirection of users to malicious external domains.\nAs the injected script executes in the victim's browser, the risk profile is elevated for any user interacting with the injected content, particularly those with higher privilege levels.",
  "technicalDetails": "The vulnerability resides in the handling of the 'not_found' attribute within the Pods shortcode implementation. The plugin fails to adequately sanitize input data provided to this attribute before it is stored or subsequently rendered in the DOM.\nWhen a user with contributor-level privileges or higher creates or edits a post, they can insert a crafted Pods shortcode containing an arbitrary payload within the 'not_found' attribute. Because the application logic does not perform rigorous input validation or context-aware output encoding, the browser interprets the payload as executable JavaScript rather than plain text.\nThe attack flow proceeds as follows: 1) The authenticated attacker injects a malicious script tag, such as '<script>alert(document.cookie)</script>', into the 'not_found' parameter of the Pods shortcode within a post or page. 2) The WordPress database stores this content without modification. 3) When any user, including administrators or visitors with higher privileges, views the post, the plugin renders the content and embeds the malicious script directly into the HTML response. 4) The victim's browser processes the injected script, leading to unauthorized code execution.\nThis Stored XSS variant is particularly dangerous because the payload persists in the database, ensuring that every user who visits the affected page becomes a target. The lack of output escaping prevents the browser from safely distinguishing between legitimate static content and user-supplied malicious strings. The vulnerability effectively leverages the trust between the server and the client, as the injected script originates from the legitimate origin of the WordPress site, potentially bypassing certain browser-based security filters.\nPost-exploitation impact is significant; by executing scripts in the context of an administrator, an attacker can manipulate site content, exfiltrate sensitive session cookies, perform unauthorized API calls, or modify site configurations to maintain persistence. Given the nature of the Pods plugin, which often interacts with custom content types and fields, the surface area for this exploit is extensive across any page where these shortcodes are utilized."
}