CVE-2014-7956: Cross-site scripting (XSS) vulnerability in the Pods plugin before 2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter in an edit action in the pods p

medium Affects pods (WordPress plugin). Feed 2026.10.29.1, updated 2026-10-28; published 2015-01-15; advisory modified 2026-06-17.

Cross-site scripting (XSS) vulnerability in the Pods plugin before 2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter in an edit action in the pods p

Package: pods (WordPress plugin) WordPress
Affected versions: <=2.4.3
Fixed in: no fix recorded
Severity: medium CVSS 4.3
Exploitation: not on CISA KEV · EPSS 2% (81.1th percentile)
Published: 2015-01-15
Source: nvd

References

CWE-79

NVD record pods (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2023-6999 high The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Remote Co same package: pods (WordPress plugin)
CVE-2014-7957 medium Multiple cross-site request forgery (CSRF) vulnerabilities in the Pods plugin before 2.5 f same package: pods (WordPress plugin)
CVE-2023-6967 high The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to SQL Injec same package: pods (WordPress plugin)
CVE-2021-24338 medium The Pods – Custom Content Types and Fields WordPress plugin before 2.7.27 was vulnerable t same package: pods (WordPress plugin)
CVE-2021-24339 medium The Pods – Custom Content Types and Fields WordPress plugin before 2.7.27 was vulnerable t same package: pods (WordPress plugin)
CVE-2023-6965 medium The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Missing A same package: pods (WordPress plugin)