CVE-2026-54191: WordPress Pods plugin <= 3.3.8 - Cross Site Scripting (XSS) vulnerability

Synopsis

This is a reflected or stored cross-site scripting (XSS) vulnerability in the Pods Framework WordPress plugin, versions 3.3.8 and earlier. The flaw is reachable over the network without any authentication, but it requires a victim to interact with a malicious link or page, as indicated by the CVSS vector. Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the victim's browser, enabling session token theft, page content manipulation, and limited disruption of the affected service. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as a fix version is published upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, so an attacker must be able to reach the web service to deliver a malicious payload.

• AuthenticationNot required

  No account or credentials are needed; the vulnerability is exploitable by any unauthenticated party.

• Victim interactionRequired

  A victim must follow a crafted link or visit a malicious page, making social engineering a necessary step in the attack chain.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race conditions, or environment-specific factors.

Blast Radius

• An attacker can execute arbitrary JavaScript in the victim's browser session, enabling theft of session cookies or authentication tokens.
• Injected scripts can read and exfiltrate data visible in the victim's browser context, including page content and form inputs.
• The attacker can silently modify the rendered page, redirecting users or presenting fraudulent content.
• The scope is marked as Changed in the CVSS vector, meaning impact can extend beyond the vulnerable component to other browser-origin resources the victim's session can reach.