CVE-2024-3956

Root

Cause

The Pods – Custom Content Types and Fields plugin for WordPress allows authenticated users to supply arbitrary attributes in the Pod Form widget. In all versions up to 3.2.1, the plugin fails to properly sanitize user input and escape output for these attributes, leading to a Stored Cross-Site Scripting (XSS) vulnerability [1].

Attack

Vector

An attacker must be an authenticated WordPress user with at least contributor-level access. By crafting a malicious attribute value in the Pod Form shortcode or block, they can inject arbitrary JavaScript or HTML. The injected payload is stored on the server and executes in the browser of any user who later accesses the affected page [1].

Impact

Successful exploitation allows the attacker to execute web scripts in the context of a victim's session. This can lead to actions such as stealing session cookies, redirecting users, or defacing content – all while the victim's browser trusts the origin of the WordPress site.

Mitigation

The vulnerability is patched in Pods 3.2.1.1. Hotfixes are also available for older supported branches (2.7, 2.8, 2.9, 3.0, and 3.1) [1]. Administrators should update their installations immediately. No workaround is provided for unpatched versions.