TI-2021-06630 Aliases CVE-2021-24338 GHSA-32xh-g4cw-vcw5

Pods < 2.7.27 - Authenticated Stored Cross-Site Scripting (XSS)

LOW 26CWE-79Published 2021-06-21 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

The Pods – Custom Content Types and Fields WordPress plugin before 2.7.27 was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Singular Label' field parameter.

Why it matters now

EPSS 0.00792 56th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Pods – Custom Content Types and Fields (Pods Framework Team): 2.7.27

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
sc0ttkclark	Pods – Custom Content Types and Fields	2.4.4.1 and later; 2.7.27 to before 2.7.27	2.7.27	Patch available	CNA

Pods – Custom Content Types and Fields Vendorsc0ttkclark Affected 2.4.4.1 and later; 2.7.27 to before 2.7.27 Fixed in 2.7.27 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:podsfoundation:pods::::::wordpress::*	before 2.7.27	Vulnerable	sc0ttkclark

cpe:2.3:a:podsfoundation:pods:*:*:*:*:*:wordpress:*:* Versions before 2.7.27 Vulnerable ·sc0ttkclark

Remediation

Fix · CNA Pods – Custom Content Types and Fields (Pods Framework Team) Fixed in 2.7.27

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2021-06-21
Pods – Custom Content Types and Fields 2.4.4.1*, 2.7.27
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2021-06631 Pods < 2.7.27 - Authenticated Stored Cross-Site Scripting (XSS)Priority LOW 26
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2021-24338
2026-10-03 Alias added: GHSA-32xh-g4cw-vcw5

References

Exploit 1

https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-24338

Advisory 1

https://wpscan.com/vulnerability/d5b015f3-90c7-4d51-a71d-630d60965151

TI-2025-01242 Pods < 3.2.8.2 - Admin+ SQL Injection CVSS 3.1CRITICAL 9.8
TI-2024-10992 Pods – Custom Content Types and Fields < 3.2.8.1 - Admin+ Stored XSS CVSS 3.1MEDIUM 6.1
TI-2024-09169 Pods < 3.2.7.1 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8
TI-2023-06398 Pods - Custom Content Types and Fields - Authenticated (Contributor+) Remote Code Execution CVSS 3.1HIGH 8.8
TI-2023-06369 Pods - Custom Content Types and Fields - Authenticated (Contributor+) SQL Injection via Shortcode CVSS 3.1HIGH 8.8
TI-2023-09590 WordPress Pods Plugin <= 2.9.10.2 is vulnerable to Cross Site Request Forgery (CSRF) CVSS 3.1HIGH 8.8

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences