Pods – Custom Content Types and Fields

Pods through 3.3.9.1 does not adequately sanitize and escape the not_found attribute of its shortcode. A Contributor or higher can store script in that attribute and have it execute when another user views the affected page.

Pods versions 3.1.0 through 3.3.9.1 do not restrict which function a display callback may resolve to. An Author can read arbitrary server files, including files outside the web root, when restricted display-callback mode is active; that mode is the automatic default on sites first using Pods before version 3.1.

Pods before 3.3.9.1 compares display callbacks incorrectly against its blocked-function list. An Author or higher can execute arbitrary server-side code when restricted display-callback mode is active, which is the automatic default for installations first created before Pods 3.1.

Pods through 3.3.9 routes pods_admin AJAX failures for method allowlisting, nonce verification, authentication, and capabilities through pods_error(). Under its JSON meta-box-loader compatibility path, pods_error() only logs the failure and returns false instead of terminating the request, so the protected administrative operation continues. An unauthenticated attacker can invoke administrator actions, overwrite any user's password, or obtain Administrator privileges. The public.

Pods is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 3.3.8.

Pods is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.

Pods is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Pods is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Pods – Custom Content Types and Fields is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Pods – Custom Content Types and Fields is affected by a security weakness. Exploitation requires an authenticated contributor account. The resulting impact depends on how the affected component exposes the vulnerable operation.

Pods – Custom Content Types and Fields is affected by SQL injection. Exploitation requires an authenticated contributor account. A successful request can alter database queries and expose or modify WordPress data.

Pods – Custom Content Types and Fields is affected by a security weakness. Exploitation requires an authenticated contributor account. The resulting impact depends on how the affected component exposes the vulnerable operation.

Pods is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

Pods – Custom Content Types and Fields is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Pods – Custom Content Types and Fields is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Pods is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Pods is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.