CVE-2026-76573

Name of the Vulnerable Software and Affected Versions Pods – Custom Content Types and Fields versions prior to 3.3.9.2

Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts through the not found shortcode attribute, which execute when a user accesses the affected page.

Recommendations Update to a version newer than 3.3.9.1.