CVE-2024-3956

The Pods – Custom Content Types and Fields plugin through version 3.2.1 contains a stored cross-site scripting vulnerability in its Pod Form widget caused by inadequate sanitization of user-supplied attributes and missing output escaping. Authenticated users with contributor permissions or higher can inject malicious scripts into pages, which then execute for anyone visiting those affected pages.

Based on public CVE data (MITRE/NVD).