CVE-2026-76573: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in sc0ttkclark Pods – Custom Content Types and Fields

CVE-2026-76573 is a stored cross-site scripting vulnerability in the Pods – Custom Content Types and Fields WordPress plugin. The flaw exists in the handling of the 'not_found' shortcode attribute, where input is not properly sanitized or escaped before being rendered in web pages. This allows authenticated attackers with contributor-level privileges or higher to inject arbitrary JavaScript code that executes in the context of users viewing the compromised pages. The vulnerability affects all versions up to and including 3.3.9.1. No official remediation or patch has been confirmed as of the published date.

Successful exploitation allows an attacker with contributor-level access to inject persistent malicious scripts into pages. These scripts execute in the browsers of users who visit the injected pages, potentially leading to session hijacking, privilege escalation, or other client-side attacks. The vulnerability impacts confidentiality and integrity but does not affect availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or limiting use of the 'not_found' shortcode attribute if possible.