SEGURIDAD DE PLUGINS
Vulnerabilidades conocidas, compatibilidad con PHP y alternativas más seguras para el plugin de WordPress Pods — verificado contra la base de datos de seguridad local de WP Clinic.
podscontent typescustom fieldscustom post typesCustom Taxonomiespods
14 CVEs conocidos registrados para Pods.
| CVE | Vulnerabilidad | Tipo | Gravedad | Afectadas | Corregido en | Publicado | Estado |
|---|---|---|---|---|---|---|---|
| CVE-2026-54191 | Pods – Custom Content Types and Fields [pods] < 3.3.9 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Alta 7,1 | < 3.3.9 | 3.3.9 | 2026-06-15 | ✓ corregido en la última versión |
| CVE-2024-11849 | Pods – Custom Content Types and Fields [pods] < 3.2.8.1 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 6,1 | < 3.2.8.1 | 3.2.8.1 | 2024-12-16 | ✓ corregido en la última versión |
| CVE-2024-9883 | Pods – Custom Content Types and Fields [pods] < 3.2.7.1 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 4,8 | < 3.2.7.1 | 3.2.7.1 | 2024-10-15 | ✓ corregido en la última versión |
| CVE-2024-6297 | Pods – Custom Content Types and Fields [pods] < 3.2.2 | Código malicioso embebido | Crítica 10,0 | < 3.2.2 | 3.2.2 | 2024-06-25 | ✓ corregido en la última versión |
| CVE-2024-3956 | Pods – Custom Content Types and Fields [pods] < 3.2.1.1 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 3.2.1.1 | 3.2.1.1 | 2024-05-09 | ✓ corregido en la última versión |
| CVE-2023-6999 | Pods – Custom Content Types and Fields [pods] < 3.1 | Neutralización incorrecta de elementos especiales en un comando (inyección de comandos) | Alta 8,8 | < 3.1 | 3.1 | 2024-03-28 | ✓ corregido en la última versión |
| CVE-2023-6965 | Pods – Custom Content Types and Fields [pods] < 3.0.10.2 | Falta de control de autorización | Media 4,3 | < 3.0.10.2 | 3.0.10.2 | 2024-03-28 | ✓ corregido en la última versión |
| CVE-2023-6967 | Pods – Custom Content Types and Fields [pods] < 3.1 | Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) | Alta 8,8 | < 3.1 | 3.1 | 2024-03-28 | ✓ corregido en la última versión |
The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
Several plugins for WordPress hosted on WordPress.org have been compromised and injected with malicious PHP scripts. A malicious threat actor compromised the source code of various plugins and injected code that exfiltrates database credentials and is used to create new, malicious, administrator users and send that data back to a server. Currently, not all plugins have been patched and we strongly recommend uninstalling the plugins for the time being and running a complete malware scan.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Pod Form widget in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
Update the WordPress Pods plugin to the latest available version (at least 3.0.10.2). Nex Team discovered and reported this Remote Code Execution (RCE) vulnerability in WordPress Pods Plugin. This could allow a malicious actor to execute commands on the target website. This can be used to gain backdoor access to then take full control of the website. This vulnerability has been fixed in version 3.0.10.2. Have additional information or questions about this entry? Get in touch.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
Update the WordPress Pods plugin to the latest available version (at least 3.0.10.2). Nex Team discovered and reported this Broken Access Control vulnerability in WordPress Pods Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action. This vulnerability has been fixed in version 3.0.10.2. Have additional information or questions about this entry? Get in touch.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to SQL Injection via shortcode in all versions up to, and including, 3.0.10 (with the exception of 2.7.31.2, 2.8.23.2, 2.9.19.2) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor level access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
| CVE | Vulnerabilidad | Tipo | Gravedad | Afectadas | Corregido en | Publicado | Estado |
|---|---|---|---|---|---|---|---|
| CVE-2023-33999 | Pods – Custom Content Types and Fields [pods] < 2.8.23 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Alta 7,1 | < 2.8.23 | 2.8.23 | 2023-07-18 | ✓ corregido en la última versión |
| — | Pods – Custom Content Types and Fields [pods] < 2.9.11 | — | Desconocido | < 2.9.11 | 2.9.11 | 2023-01-20 | ✓ corregido en la última versión |
| CVE-2023-23790 | Pods – Custom Content Types and Fields [pods] < 2.9.11 | Falsificación de petición en sitios cruzados (CSRF) | Alta 7,1 | < 2.9.11 | 2.9.11 | 2023-01-20 | ✓ corregido en la última versión |
| — | Pods – Custom Content Types and Fields [pods] < 2.7.29 | — | Desconocido | < 2.7.29 | 2.7.29 | 2021-08-06 | ✓ corregido en la última versión |
| CVE-2021-24339 | Pods – Custom Content Types and Fields [pods] < 2.7.27 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 2.7.27 | 2.7.27 | 2021-01-15 | ✓ corregido en la última versión |
| CVE-2021-24338 | Pods – Custom Content Types and Fields [pods] < 2.7.27 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 2.7.27 | 2.7.27 | 2021-01-15 | ✓ corregido en la última versión |
| — | Pods – Custom Content Types and Fields [pods] < 2.5.1.2 | — | Desconocido | < 2.5.1.2 | 2.5.1.2 | 2015-03-16 | ✓ corregido en la última versión |
| — | Pods – Custom Content Types and Fields [pods] < 2.5.1.2 | — | Desconocido | < 2.5.1.2 | 2.5.1.2 | 2015-03-16 | ✓ corregido en la última versión |
| CVE-2014-7957 | Pods – Custom Content Types and Fields [pods] < 2.5 | Falsificación de petición en sitios cruzados (CSRF) | Desconocido | < 2.5 | 2.5 | 2014-10-07 | ✓ corregido en la última versión |
| CVE-2014-7956 | Pods – Custom Content Types and Fields [pods] < 2.5 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Desconocido | < 2.5 | 2.5 | 2014-10-07 | ✓ corregido en la última versión |
| — | Pods – Custom Content Types and Fields [pods] < 3.2.8.2 | Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) | Crítica 9,8 | < 3.2.8.2 | 3.2.8.2 | 0000-00-00 | ✓ corregido en la última versión |
| — | Pods – Custom Content Types and Fields [pods] < 2.7.29 | — | Desconocido | < 2.7.29 | 2.7.29 | — | ✓ corregido en la última versión |
| — | Pods – Custom Content Types and Fields [pods] < 2.5.1.2 | — | Desconocido | < 2.5.1.2 | 2.5.1.2 | — | ✓ corregido en la última versión |
Update the WordPress Pods plugin to the latest available version. Rafie Muhammad (Patchstack) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Pods Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 2.8.23.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
The Pods plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.9.10.2. This is due to missing or incorrect nonce validation when deleting pods. This makes it possible for unauthenticated attackers to delete pods via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
Update the WordPress Pods plugin to the latest available version (at least 2.9.11). Rafshanzani Suhada discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Pods Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. For example a password change which will then allow the malicious actor to login into the admin account. This vulnerability has been fixed in version 2.9.11.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 2.7.28 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The plugin was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Menu Label' field parameter. It is recommended that the Pods WordPress plugin be updated to at least version 2.7.27, which fixes the vulnerability.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: WPScan
The plugin was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Singular Label' field parameter. It is recommended that the Pods WordPress plugin be updated to at least version 2.7.27, which fixes the vulnerability.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: WPScan
Because of this vulnerability, remote authenticated users can execute arbitrary SQL commands. Update the plugin.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to SQL Injection via the ‘orderby’ parameter in versions before 2.5.1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
Multiple cross-site request forgery (CSRF) vulnerabilities in the Pods plugin before 2.5 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) conduct cross-site scripting (XSS) attacks via the toggled parameter in a toggle action in the pods-components page to wp-admin/admin.php, (2) delete a pod in a delete action in the pods page to wp-admin/admin.php, (3) reset pod settings and data via the pods_reset parameter in the pod-settings page to wp-admin/admin.php, (4) deactivate and reset pod data via the pods_reset_deactivate parameter in the pod-settings page to wp-admin/admin.php, (5) delete the admin role via the id parameter in a delete action in the pods-component-roles-and-capabilities page to wp-admin/admin.php, or (6) enable "roles and capabilities" in a toggle action in the pods-components page to wp-admin/admin.php.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
Cross-site scripting (XSS) vulnerability in the Pods plugin before 2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter in an edit action in the pods page to wp-admin/admin.php.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.2.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The plugin is vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability in multiple parameters.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: WPScan
Version/s Tested: 2.5.1.1 and previous Description: Pods is a popular custom content types and fields plugin for WordPress. In the PodsUI class, which is used to build Pods administration interfaces, the orderby SQL query is set via a GET variable, which was not properly sanitized. Technical Description: At approximately Line 859 of the PodsUI class an orderby parameter, which is passed from the browser in a GET variable was subsequently used in an SQL query without being properly sanitized. The PodsUI class, which is not only used for the Pods admin, but is also employed by many end-users to create front-end and back-end content management interfaces for non-admin users. Proof of Concept (PoC): The following GET request will cause the SQL query to execute and sleep for 10 seconds if in any page that uses the PodsUI class: http://local.dev/wp-admin/admin.php?page=pods-manage-<PODNAME>&orderby=post_date%2c(select%20*%20from%20(select(sleep(10)))a) Which will generate the following SQL Query: SELECT DISTINCT `t`.* FROM `wp_pods_<PODNAME>` AS `t` ORDER BY post_date,(select * from (select(sleep(10)))a), `t`.`name`, `t`.`id` LIMIT 0, 25 <PODNAME> must be a valid Advanced Content Type Pod Impact: Complete compromise of the WordPress installation by an uny third-party that has access to an interface, front-end or back-end, created with PodsUI. Access to Pods Admin defaults to admin level user only, but can be changed. Custom interfaces created with PodsUI have access-levels determined on a per interface basis. They are often used to created interfaces with controlled, limited content editing capabilities. Fix: A security release 2.5.1.2 made a change as seen in this diff: https://github.com/pods-framework/pods/commit/7eda9c183a97cc6987624f8f05d02854142d493b/?diff=split to correct the problem. All affected branches have been patched on WordPress.org and Github. Timeline: March 14th 2015 Issue found via internal review. Release and disclosure delayed due to weekend timing and awaiting response from WordPress.org security team. March 14th 2015 WordPress.org security team notified, requesting forced update. No response as of March 16th 2015. March 16th 2015 New version and patches released. Credits: Vulnerability discovered and fixed by Scott Kingsley Clark, Lead Developer of Pods (Pods.io)
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: WPScan
Mantén Pods actualizado — 3.3.9 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").
Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.
Ejecuta un escaneo pasivo gratis ahora, o crea una cuenta gratuita e instala el plugin de WP Clinic para un escaneo profundo de toda tu cuenta de hosting y reparación asistida por IA.