Critical

Pods <= 2.4.3 - Multiple Cross-Site Request Forgery

Disclosed: 12.01.2015
Updated: 11.10.2026 10:22

Multiple cross-site request forgery (CSRF) vulnerabilities in the Pods plugin before 2.5 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) conduct cross-site scripting (XSS) attacks via the toggled parameter in a toggle action in the pods-components page to wp-admin/admin.php, (2) delete a pod in a delete action in the pods page to wp-admin/admin.php, (3) reset pod settings and data via the pods_reset parameter in the pod-settings page to wp-admin/admin.php, (4) deactivate and reset pod data via the pods_reset_deactivate parameter in the pod-settings page to wp-admin/admin.php, (5) delete the admin role via the id parameter in a delete action in the pods-component-roles-and-capabilities page to wp-admin/admin.php, or (6) enable "roles and capabilities" in a toggle action in the pods-components page to wp-admin/admin.php.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
WordPress plugin	Pods – Custom Content Types and Fields	<= 2.4.3	2.5

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/19b4a27d-d9de-4567-86cd-8ec821ee299a?source=api-prod

CVSS score 9.6/10

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Weakness (CWE): CWE-352
Platform: WordPress
Package: Pods – Custom Content Types and Fields
Disclosed: 12.01.2015
Updated: 11.10.2026 10:22

Sources and licenses

Wordfence Intelligence - 19b4a27d-d9de-4567-86cd-8ec821ee299a - Wordfence Intelligence

This record contains material that is subject to copyright

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

https://www.cve.org/Legal/TermsOfUse

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/

Wordfence Intelligence

Wordfence Intelligence - Defiant, Inc.
Copyright Defiant, Inc. All rights reserved except as granted below.
License grant, section 3.1 of the Wordfence Intelligence Terms and Conditions (January 26, 2026):

Subject to this Agreement, Company hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute the Service. Any copy you make for such purposes is authorized provided that you reproduce Company’s copyright designation, this license, and the license of any disclosed Company licensor in any such copy.

Full applicable Agreement: https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/

Vulnerability history: Pods – Custom Content Types and Fields

All published vulnerabilities of this package (WordPress plugin), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (19) in the archive

Total entries: 19
First → latest: 01.2015 09.2026
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

Critical 3
High 5
Medium 11

Disclosures per year

2017: 0
2018: 0
2019: 0
2020: 0
2021: 3
2022: 0
2023: 1
2024: 6
2025: 1
2026: 5

earlier: 3

28.08.2026

Pods – Custom Content Types and Fields < 3.3.9.1 - Authenticated (Author+) Remote Code Execution

High · 8.8 CVE-2026-74851 < 3.3.9.1 3.3.9.1
15.08.2026

Pods <= 3.3.9 - Unauthenticated Privilege Escalation via Authorization Bypass to Admin Methods via 'pods_admin' AJAX Router

Critical · 9.8 CVE-2026-19598 >= 2.8, <= 2.8.23.3, >= 2.9, <= 2.9.19.3, >= 3.0, <= 3.0.10.3, >= 3.1, <= 3.1.4.1, >= 3.2, <= 3.2.8.2, >= 3.3, <= 3.3.9 2.8.23.4, 2.9.19.4, 3.0.10.4, 3.1.4.2, 3.2.8.3, 3.3.9.1
15.06.2026

Pods – Custom Content Types and Fields <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting

High · 7.2 CVE-2026-54191 <= 3.3.8 3.3.9
28.03.2024

Pods - Custom Content Types and Fields - Authenticated (Contributor+) Remote Code Execution

High · 8.8 CVE-2023-6999 < 2.7.31, >= 2.8, < 2.8.23.2, >= 3, < 3.0.10.2 2.7.31.2, 2.8.23.2, 2.9.19.2, 3.0.10.2
28.03.2024

Pods - Custom Content Types and Fields - Authenticated (Contributor+) SQL Injection via Shortcode

High · 8.8 CVE-2023-6967 < 2.7.31, >= 2.8, < 2.8.23.2, >= 3, < 3.0.10.2 2.7.31.2, 2.8.23.2, 2.9.19.2, 3.0.10.2
20.01.2023

Pods <= 2.9.10.2 - Cross-Site Request Forgery

High · 7.1 CVE-2023-23790 <= 2.9.10.2 2.9.11
16.03.2015

Pods – Custom Content Types and Fields < 2.5.1.2 - SQL Injection

Critical · 9.8 e95b2bfe-8675-4932-9b37-73ad15fa228e < 2.5.1.2 2.5.1.2
12.01.2015

Pods <= 2.4.3 - Multiple Cross-Site Request Forgery this entry

Critical · 9.6 CVE-2014-7957 <= 2.4.3 2.5

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application