The Pods – Custom Content Types and Fields plugin for WordPress suffers from a stored XSS vulnerability (CWE-79) in its Pod Form widget due to inadequate sanitization and escaping of user-supplied attributes. Authenticated attackers with contributor or higher privileges can inject arbitrary JavaScript that executes in the context of users visiting the compromised pages. This vulnerability affects all versions up to and including 3.2.1. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, low privileges required, and user interaction needed, with partial impact on confidentiality and integrity but no impact on availability.

An attacker with contributor-level access or higher can inject malicious scripts that execute in the browsers of users viewing the affected pages. This can lead to partial compromise of confidentiality and integrity of user data within the context of the affected site. There is no reported impact on availability. The vulnerability requires authentication and user interaction to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or limiting use of the Pod Form widget. Monitor official channels for updates from the plugin vendor regarding patches or mitigations.