Pods – Custom Content Types and Fields

92 Quality Score

Active Installs

23/30

With 100,000 active installs, Pods trails the leading alternatives by 10x to 20x, which explains the middling popularity score despite a long history in the ecosystem.

Update Freshness

25/25

Updated within the last few weeks and confirmed against WordPress 7.0, the maintenance signal is as strong as it gets in this category.

User Rating

14/15

A 96 out of 100 across 417 reviews is excellent and indicates consistently satisfied users rather than a small vocal fanbase.

Support Health

15/15

With 13 total threads and only 61.5% resolved, the support footprint is thin and resolution rate is below average for a plugin of this size.

WP Compatibility

15/15

Tested with WordPress 7.0 and requiring only PHP 7.2 plus WordPress 6.3, the compatibility bar is broad and current.

Scores higher than 99% of indexed plugins

About

Pods is a framework for creating, managing, and deploying customized content types and fields for any project.

Active Installs 100k+

Rating ★★★★½ 4.8/5

Last Updated 2026-08-31 5:08pm GMT

Requires WordPress 6.3+

Tested Up To 7.1

Requires PHP 7.2+

Security History

19 known vulnerabilities, all patched

3 Critical 5 High 11 Medium

Most recent: September 4, 2026

View details ▸

Pods <= 3.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode Attribute Medium

September 4, 2026 Patched in ["3.3.9.2"] CVE-2026-76573

Pods – Custom Content Types and Fields 3.3 - 3.3.9.1 - Authenticated (Author+) Arbitrary File Read Medium

September 4, 2026 Patched in ["3.3.9.2"] CVE-2026-74853

Pods – Custom Content Types and Fields < 3.3.9.1 - Authenticated (Author+) Remote Code Execution High

August 28, 2026 Patched in ["3.3.9.1"] CVE-2026-74851

Pods <= 3.3.9 - Unauthenticated Privilege Escalation via Authorization Bypass to Admin Methods via 'pods_admin' AJAX Router Critical

August 15, 2026 Patched in ["2.8.23.4","2.9.19.4","3.0.10.4","3.1.4.2","3.2.8.3","3.3.9.1"] CVE-2026-19598

Pods – Custom Content Types and Fields <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting High

June 15, 2026 Patched in ["3.3.9"] CVE-2026-54191

Pods – Custom Content Types and Fields <= 3.2.8.1 - Authenticated (Admin+) Stored Cross-Site Scripting Medium

March 2, 2025 Patched in ["3.2.8.2"] CVE-2025-1446

Pods – Custom Content Types and Fields <= 3.2.8 - Authenticated (Admin+) Stored Cross-Site Scripting Medium

December 16, 2024 Patched in ["3.2.8.1"] CVE-2024-11849

Pods <= 3.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting Medium

October 15, 2024 Patched in ["3.2.7.1"] CVE-2024-9883

Pods – Custom Content Types and Fields <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pod Form Redirect URL Medium

May 9, 2024 Patched in ["3.2.1.1"] CVE-2024-3956

Pods - Custom Content Types and Fields - Authenticated (Contributor+) SQL Injection via Shortcode High

March 28, 2024 Patched in ["2.7.31.2","2.8.23.2","2.9.19.2","3.0.10.2"] CVE-2023-6967

Pods - Custom Content Types and Fields - Missing Authorization Medium

March 28, 2024 Patched in ["2.7.31.2","2.8.23.2","2.9.19.2","3.0.10.2"] CVE-2023-6965

Pods - Custom Content Types and Fields - Authenticated (Contributor+) Remote Code Execution High

March 28, 2024 Patched in ["2.7.31.2","2.8.23.2","2.9.19.2","3.0.10.2"] CVE-2023-6999

Pods <= 2.9.10.2 - Cross-Site Request Forgery High

January 20, 2023 Patched in ["2.9.11"] CVE-2023-23790

Pods – Custom Content Types and Fields <= 2.7.28 - Authenticated (Admin+) Cross-Site Scripting Medium

August 6, 2021 Patched in ["2.7.29"]

Pods 2.4.4.1 - 2.7.26 - Authenticated Stored Cross-Site Scripting Medium

January 15, 2021 Patched in ["2.7.27"] CVE-2021-24338

Pods <= 2.7.26 - Authenticated Stored Cross-Site Scripting via Menu Label field Medium

January 15, 2021 Patched in ["2.7.27"] CVE-2021-24339

Pods – Custom Content Types and Fields < 2.5.1.2 - SQL Injection Critical

March 16, 2015 Patched in ["2.5.1.2"]

Pods <= 2.4.3 - Cross-Site Scripting Medium

January 12, 2015 Patched in ["2.5"] CVE-2014-7956

Pods <= 2.4.3 - Multiple Cross-Site Request Forgery Critical

January 12, 2015 Patched in ["2.5"] CVE-2014-7957

What It Does

Pods is a framework for building custom post types, custom taxonomies, and custom fields directly from the WordPress admin without writing PHP. It goes further than most plugins in its category by letting you relate custom content to each other, create custom settings pages, and even build entire page templates using its built-in template engine. In practice, you can model a real estate listing, directory, or product catalog using only the WordPress dashboard.

Who It's For

Pods is a strong fit for site builders and developers who need more than a single custom post type or a flat set of fields, particularly those building relational content like directories, member directories, event calendars, or internal tools. The free tier handles roughly 80% of what most projects require, and the Pods Framework Pro add-on extends it with advanced relationship types, templates, and form integrations. If you are comfortable with admin-driven workflows rather than code-first configuration, Pods is built for you.

Who Should Skip It

If you only need to register one or two post types and a handful of meta boxes, Advanced Custom Fields or Custom Post Type UI will get you there with less surface area to learn. Developers who prefer defining schemas in code with strict typing and version control should look at Meta Box or a custom plugin instead.

The Bottom Line

Pods is a mature, actively maintained framework with outstanding ratings that punches above its install count thanks to genuine relational content features most rivals lack. The weaker support footprint and lower adoption mean you trade some community breadth for more capability per square inch. Overall Quality Score of 86.02 reflects a very capable plugin that is not the most popular kid on the block.

Related Plugins

Advanced Custom Fields (ACF) 85/100

Pick ACF if you mainly need flexible content fields attached to existing post types and want the largest user community and most third-party integrations.

Custom Post Type UI 88/100

Pick Custom Post Type UI if you only need to register custom post types and taxonomies and want a lightweight, focused tool with 1 million installs.

Meta Box 87/100

Pick Meta Box if you are a developer who wants a code-friendly field builder with strong performance and a generous free tier of field types.

Checkout Field Editor (Checkout Manager) for WooCommerce 87/100

Pick this alternative only if you specifically need to edit WooCommerce checkout, billing, or shipping fields and nothing else.

Admin Columns 85/100

Pick Admin Columns if your main pain point is customizing the admin list table columns rather than building content models.