diff --git a/classes/PodsAdmin.php b/classes/PodsAdmin.php
index eaf7b0cef0..eafd9e78f2 100644
--- a/classes/PodsAdmin.php
+++ b/classes/PodsAdmin.php
@@ -4676,7 +4676,11 @@ public function add_debug_information( $info ) {
 
 		$settings_values = $settings->get_settings();
 
-		$auto_start = pods_v( $auto_start, $settings_fields['session_auto_start']['data'], __( 'Unknown', 'pods' ) );
+		$session_auto_start_data = ( isset( $settings_fields['session_auto_start'] ) && isset( $settings_fields['session_auto_start']['data'] ) )
+			? $settings_fields['session_auto_start']['data']
+			: [];
+
+		$auto_start = pods_v( $auto_start, $session_auto_start_data, __( 'Unknown', 'pods' ) );
 
 		require_once ABSPATH . '/wp-admin/includes/file.php';
 
@@ -4687,6 +4691,13 @@ public function add_debug_information( $info ) {
 
 		global $wpdb;
 
+		// Cache session_save_path() once and guard the FS checks below. Hosts that
+		// restrict /var/lib/php/sessions through open_basedir (or run memcached/redis
+		// handlers with tcp:// handlers) would otherwise trigger file_exists()
+		// warnings on every Site Health request -- see issue #7263.
+		$save_path             = session_save_path();
+		$can_check_session_fs  = $filesystem_ok && $wp_filesystem && ! empty( $save_path ) && 0 !== strpos( $save_path, 'tcp://' );
+
 		$info['pods'] = [
 			'label'       => 'Pods',
 			'description' => __( 'Debug information for Pods installations.', 'pods' ),
@@ -4717,11 +4728,11 @@ public function add_debug_information( $info ) {
 				],
 				'pods-session-save-path-exists'      => [
 					'label' => __( 'Session Save Path Exists', 'pods' ),
-					'value' => ( $filesystem_ok && $wp_filesystem && $wp_filesystem->exists( session_save_path() ) ) ? __( 'Yes', 'pods' ) : __( 'No', 'pods' ),
+					'value' => ( $can_check_session_fs && $wp_filesystem->exists( $save_path ) ) ? __( 'Yes', 'pods' ) : __( 'No', 'pods' ),
 				],
 				'pods-session-save-path-writable'    => [
 					'label' => __( 'Session Save Path Writeable', 'pods' ),
-					'value' => ( $filesystem_ok && $wp_filesystem && $wp_filesystem->is_writable( session_save_path() ) ) ? __( 'Yes', 'pods' ) : __( 'No', 'pods' ),
+					'value' => ( $can_check_session_fs && $wp_filesystem->is_writable( $save_path ) ) ? __( 'Yes', 'pods' ) : __( 'No', 'pods' ),
 				],
 				'pods-session-max-lifetime'          => [
 					'label' => __( 'Session Max Lifetime', 'pods' ),
diff --git a/classes/PodsField.php b/classes/PodsField.php
index 47238a1012..86ebc0dea1 100644
--- a/classes/PodsField.php
+++ b/classes/PodsField.php
@@ -975,15 +975,180 @@ public function maybe_sanitize_output( $value, $options = null ) {
 
 		if ( $should_sanitize ) {
 			if ( is_string( $value ) ) {
-				$value = wp_kses_post( $value );
+				$value = $this->sanitize_output_string( $value );
 			} elseif ( is_array( $value ) || is_object( $value ) ) {
-				$value = wp_kses_post_deep( $value );
+				$value = $this->sanitize_output_array( $value );
 			}
 		}
 
 		return $value;
 	}
 
+	/**
+	 * Sanitize a string field value before output.
+	 *
+	 * Code (Syntax Highlighting) fields commonly embed third-party scripts and
+	 * iframes (SimpleShop, Google Reviews, TikTok widgets, etc.). WordPress's
+	 * default {@see wp_kses_post()} allow-list drops external `<script src>`
+	 * and arbitrary `<iframe>` embeds, which broke such widgets starting in
+	 * Pods 3.1.x (issue #7263 and sibling #7319). For the `code` type we layer
+	 * those embeds back on top of the standard post allow-list; all other
+	 * field types keep the previous behaviour.
+	 *
+	 * @since 3.3.10
+	 *
+	 * @param string $value Raw field value.
+	 *
+	 * @return string Sanitized value.
+	 */
+	protected function sanitize_output_string( $value ) {
+		if ( 'code' === static::$type ) {
+			return $this->wp_kses_post_with_embeds( $value );
+		}
+
+		return wp_kses_post( $value );
+	}
+
+	/**
+	 * Recursively sanitize an array/object field value before output.
+	 *
+	 * @since 3.3.10
+	 *
+	 * @param array|object $value Raw field value.
+	 *
+	 * @return array|object Sanitized value.
+	 */
+	protected function sanitize_output_array( $value ) {
+		if ( 'code' === static::$type ) {
+			return $this->wp_kses_post_deep_with_embeds( $value );
+		}
+
+		return wp_kses_post_deep( $value );
+	}
+
+	/**
+	 * {@see wp_kses_post()} with extra allowance for external script and iframe embeds.
+	 *
+	 * @since 3.3.10
+	 *
+	 * @param string $value HTML to sanitize.
+	 *
+	 * @return string Sanitized HTML with embeds preserved.
+	 */
+	protected function wp_kses_post_with_embeds( $value ) {
+		return wp_kses( $value, $this->get_post_with_embeds_allowed_html() );
+	}
+
+	/**
+	 * Recursive form of {@see PodsField::wp_kses_post_with_embeds()}.
+	 *
+	 * @since 3.3.10
+	 *
+	 * @param array|object $value Value to sanitize recursively.
+	 *
+	 * @return array|object Sanitized value.
+	 */
+	protected function wp_kses_post_deep_with_embeds( $value ) {
+		if ( is_array( $value ) ) {
+			foreach ( $value as $k => $v ) {
+				$value[ $k ] = $this->sanitize_output_array( $v );
+			}
+
+			return $value;
+		}
+
+		if ( is_object( $value ) ) {
+			foreach ( $value as $k => $v ) {
+				$value->{$k} = $this->sanitize_output_array( $v );
+			}
+
+			return $value;
+		}
+
+		if ( is_string( $value ) ) {
+			return $this->wp_kses_post_with_embeds( $value );
+		}
+
+		return $value;
+	}
+
+	/**
+	 * Build the kses allow-list used for Code field output.
+	 *
+	 * Starts from {@see wp_kses_allowed_html()} for context `post` and adds
+	 * the attributes typical embed widgets produce. {@see wp_kses_allowed_html()}
+	 * already strips external script `src` and arbitrary iframe embeds, which
+	 * is what regressed in #7263.
+	 *
+	 * @since 3.3.10
+	 *
+	 * @return array<string, array<string, bool>>
+	 */
+	protected function get_post_with_embeds_allowed_html() {
+		$allowed = wp_kses_allowed_html( 'post' );
+
+		// External <script src="..."> embeds (SimpleShop, ads, analytics widgets, etc.).
+		//
+		// This is deliberately gated. wp_kses() filters tags and attributes but never
+		// the *text content* of an element, so allowing <script> unconditionally would
+		// let anyone able to edit this field store executable JavaScript that then runs
+		// for every visitor -- and code_sanitize_html is the very option an admin turns
+		// on to prevent that. Allowing it only for unfiltered_html keeps the capability
+		// boundary WordPress already uses for raw HTML.
+		//
+		// Note this is an output-time check, so it reflects the *viewer*: script-based
+		// embeds render for users holding unfiltered_html, while iframe-based embeds
+		// (YouTube, Vimeo, most third-party forms) keep working for everyone. Sites that
+		// genuinely need public script embeds can re-add them via the
+		// pods_code_field_sanitize_allowed_html filter below.
+		if ( current_user_can( 'unfiltered_html' ) ) {
+			$allowed['script'] = [
+				'src'         => true,
+				'type'        => true,
+				'async'       => true,
+				'defer'       => true,
+				'integrity'   => true,
+				'crossorigin' => true,
+				'nonce'       => true,
+				'charset'     => true,
+				'data-*'      => true,
+			];
+		}
+
+		// Inline <iframe> embeds (YouTube, Vimeo, third-party forms). wp_kses_allowed_html
+		// already permits iframe; this widens the allowed attributes that embeds actually use.
+		$iframe_attrs = [
+			'src'             => true,
+			'width'           => true,
+			'height'          => true,
+			'frameborder'     => true,
+			'allow'           => true,
+			'allowfullscreen' => true,
+			'title'           => true,
+			'loading'         => true,
+			'referrerpolicy'  => true,
+			'sandbox'         => true,
+			'name'            => true,
+			'id'              => true,
+			'style'           => true,
+			'class'           => true,
+			'data-*'          => true,
+		];
+
+		$allowed['iframe'] = isset( $allowed['iframe'] ) && is_array( $allowed['iframe'] )
+			? array_merge( $allowed['iframe'], $iframe_attrs )
+			: $iframe_attrs;
+
+		/**
+		 * Filter the kses allow-list used for Code (Syntax Highlighting) field output.
+		 *
+		 * @since 3.3.10
+		 *
+		 * @param array<string, array<string, bool>> $allowed Allowed HTML tags and attributes.
+		 */
+		return apply_filters( 'pods_code_field_sanitize_allowed_html', $allowed );
+	}
+
 	/**
 	 * Strip shortcodes based on options.
 	 *
diff --git a/tests/codeception/wpunit/Pods/AdminDebugInformationTest.php b/tests/codeception/wpunit/Pods/AdminDebugInformationTest.php
new file mode 100644
index 0000000000..ced3af2e00
--- /dev/null
+++ b/tests/codeception/wpunit/Pods/AdminDebugInformationTest.php
@@ -0,0 +1,124 @@
+<?php
+
+namespace Pods_Unit_Tests\Pods;
+
+use Pods_Unit_Tests\Pods_UnitTestCase;
+use PodsAdmin;
+
+/**
+ * @group  pods
+ * @covers PodsAdmin
+ */
+class AdminDebugInformationTest extends Pods_UnitTestCase {
+
+	/**
+	 * @var PodsAdmin
+	 */
+	private $admin;
+
+	public function setUp(): void {
+		parent::setUp();
+
+		$this->admin = new PodsAdmin();
+
+		remove_all_filters( 'pods_admin_settings_fields' );
+	}
+
+	public function tearDown(): void {
+		remove_all_filters( 'pods_admin_settings_fields' );
+
+		unset( $this->admin );
+	}
+
+	/**
+	 * Issue #7263: add_debug_information() must not emit "Undefined array key data"
+	 * when a third-party filter strips the `data` key from session_auto_start.
+	 *
+	 * @covers PodsAdmin::add_debug_information
+	 */
+	public function test_add_debug_information_handles_missing_session_data_key() {
+		add_filter( 'pods_admin_settings_fields', static function ( $fields ) {
+			if ( isset( $fields['session_auto_start'] ) ) {
+				unset( $fields['session_auto_start']['data'] );
+			}
+
+			return $fields;
+		} );
+
+		$info = [];
+
+		// Discard any warnings; we only care that no fatal/warning survives.
+		$warning_triggers = [];
+		set_error_handler( static function ( $errno, $errstr ) use ( &$warning_triggers ) {
+			$warning_triggers[] = [ 'errno' => $errno, 'errstr' => $errstr ];
+
+			return true;
+		} );
+
+		try {
+			$result = $this->admin->add_debug_information( $info );
+		} finally {
+			restore_error_handler();
+		}
+
+		$this->assertIsArray( $result );
+		$this->assertArrayHasKey( 'pods', $result );
+
+		foreach ( $warning_triggers as $trigger ) {
+			$this->assertStringNotContainsString( 'session_auto_start', $trigger['errstr'] );
+			$this->assertStringNotContainsString( 'Undefined array key "data"', $trigger['errstr'] );
+		}
+	}
+
+	/**
+	 * Issue #7263: add_debug_information() must not try to call into the
+	 * filesystem when session_save_path() is empty (handles tcp://, redis,
+	 * memcached), and must not emit file_exists/is_writable warnings when
+	 * the path is outside open_basedir.
+	 *
+	 * @covers PodsAdmin::add_debug_information
+	 */
+	public function test_add_debug_information_handles_empty_session_save_path() {
+		// Redirect session.save_path to an empty value for the call.
+		$original = session_save_path();
+
+		@ini_set( 'session.save_path', '' );
+
+		$warning_triggers = [];
+		set_error_handler( static function ( $errno, $errstr ) use ( &$warning_triggers ) {
+			$warning_triggers[] = $errstr;
+
+			return true;
+		} );
+
+		try {
+			$result = $this->admin->add_debug_information( [] );
+		} finally {
+			restore_error_handler();
+			@ini_set( 'session.save_path', $original );
+		}
+
+		$this->assertIsArray( $result );
+		$this->assertArrayHasKey( 'pods', $result );
+
+		// No file_exists()/is_writable() warnings about the session path.
+		foreach ( $warning_triggers as $errstr ) {
+			$this->assertStringNotContainsString( 'session_save_path', $errstr );
+			$this->assertStringNotContainsString( 'file_exists(', $errstr );
+			$this->assertStringNotContainsString( 'is_writable(', $errstr );
+		}
+	}
+
+	/**
+	 * @covers PodsAdmin::add_debug_information
+	 */
+	public function test_add_debug_information_includes_session_save_path_label() {
+		$result = $this->admin->add_debug_information( [] );
+
+		$this->assertArrayHasKey( 'pods', $result );
+		$this->assertArrayHasKey( 'fields', $result['pods'] );
+		$this->assertArrayHasKey( 'pods-session-save-path', $result['pods']['fields'] );
+		$this->assertArrayHasKey( 'pods-session-save-path-exists', $result['pods']['fields'] );
+		$this->assertArrayHasKey( 'pods-session-save-path-writable', $result['pods']['fields'] );
+	}
+}
diff --git a/tests/codeception/wpunit/Pods/Field/PodsFieldCodeScriptGateTest.php b/tests/codeception/wpunit/Pods/Field/PodsFieldCodeScriptGateTest.php
new file mode 100644
index 0000000000..e2275c41d1
--- /dev/null
+++ b/tests/codeception/wpunit/Pods/Field/PodsFieldCodeScriptGateTest.php
@@ -0,0 +1,158 @@
+<?php
+
+namespace Pods_Unit_Tests\Pods\Field;
+
+use PodsField_Code;
+use Pods_Unit_Tests\Pods_UnitTestCase;
+
+/**
+ * wp_kses() filters tags and attributes but never the text content of an element,
+ * so allowing <script> through the Code field allow-list lets anyone who can edit
+ * the field store executable JavaScript. code_sanitize_html is the option an admin
+ * enables specifically to prevent that, so the script allowance is gated on
+ * unfiltered_html.
+ *
+ * @group  pods-field-code
+ * @group  pods-issue-7263
+ * @covers PodsField::get_post_with_embeds_allowed_html
+ * @covers PodsField::maybe_sanitize_output
+ */
+class PodsFieldCodeScriptGateTest extends Pods_UnitTestCase {
+
+	/**
+	 * @var PodsField_Code
+	 */
+	protected $field;
+
+	/**
+	 * @var array
+	 */
+	protected $options = [ 'code_sanitize_html' => 1 ];
+
+	public function setUp(): void {
+		parent::setUp();
+
+		$this->field = new PodsField_Code();
+	}
+
+	public function tearDown(): void {
+		wp_set_current_user( 0 );
+
+		$this->field = null;
+
+		parent::tearDown();
+	}
+
+	/**
+	 * A user without unfiltered_html must not be able to emit inline script.
+	 */
+	public function test_inline_script_is_stripped_without_unfiltered_html() {
+		$subscriber = $this->factory()->user->create( [ 'role' => 'subscriber' ] );
+		wp_set_current_user( $subscriber );
+
+		$this->assertFalse( current_user_can( 'unfiltered_html' ) );
+
+		$output = $this->field->maybe_sanitize_output(
+			'<p>hi</p><script>alert(1)</script>',
+			$this->options
+		);
+
+		$this->assertStringNotContainsString( '<script', $output );
+		$this->assertStringContainsString( '<p>hi</p>', $output );
+	}
+
+	/**
+	 * The same applies to external script embeds.
+	 */
+	public function test_external_script_is_stripped_without_unfiltered_html() {
+		$subscriber = $this->factory()->user->create( [ 'role' => 'subscriber' ] );
+		wp_set_current_user( $subscriber );
+
+		$output = $this->field->maybe_sanitize_output(
+			'<script src="https://evil.example.com/x.js"></script>',
+			$this->options
+		);
+
+		$this->assertStringNotContainsString( '<script', $output );
+		$this->assertStringNotContainsString( 'evil.example.com', $output );
+	}
+
+	/**
+	 * Logged-out visitors -- the common front-end case -- must never receive script.
+	 */
+	public function test_script_is_stripped_for_anonymous_visitors() {
+		wp_set_current_user( 0 );
+
+		$output = $this->field->maybe_sanitize_output(
+			'<script>alert(document.cookie)</script>',
+			$this->options
+		);
+
+		$this->assertStringNotContainsString( '<script', $output );
+		$this->assertStringNotContainsString( 'document.cookie', $output );
+	}
+
+	/**
+	 * Iframe embeds are the common widget case and must keep working for everyone.
+	 */
+	public function test_iframe_embeds_survive_for_anonymous_visitors() {
+		wp_set_current_user( 0 );
+
+		$output = $this->field->maybe_sanitize_output(
+			'<iframe src="https://www.youtube.com/embed/abc" width="560" height="315" allowfullscreen></iframe>',
+			$this->options
+		);
+
+		$this->assertStringContainsString( '<iframe', $output );
+		$this->assertStringContainsString( 'youtube.com/embed/abc', $output );
+	}
+
+	/**
+	 * Users who hold unfiltered_html keep the embed capability the feature was added for.
+	 */
+	public function test_script_is_allowed_with_unfiltered_html() {
+		if ( is_multisite() ) {
+			$this->markTestSkipped( 'unfiltered_html is reserved for super admins on multisite.' );
+		}
+
+		$admin = $this->factory()->user->create( [ 'role' => 'administrator' ] );
+		wp_set_current_user( $admin );
+
+		if ( ! current_user_can( 'unfiltered_html' ) ) {
+			$this->markTestSkipped( 'unfiltered_html is not available in this environment.' );
+		}
+
+		$output = $this->field->maybe_sanitize_output(
+			'<script src="https://example.com/widget.js"></script>',
+			$this->options
+		);
+
+		$this->assertStringContainsString( '<script', $output );
+		$this->assertStringContainsString( 'example.com/widget.js', $output );
+	}
+
+	/**
+	 * The allow-list filter remains the documented escape hatch for sites that
+	 * deliberately want public script embeds.
+	 */
+	public function test_allowed_html_filter_can_restore_script() {
+		wp_set_current_user( 0 );
+
+		$callback = static function ( $allowed ) {
+			$allowed['script'] = [ 'src' => true ];
+
+			return $allowed;
+		};
+
+		add_filter( 'pods_code_field_sanitize_allowed_html', $callback );
+
+		$output = $this->field->maybe_sanitize_output(
+			'<script src="https://example.com/widget.js"></script>',
+			$this->options
+		);
+
+		remove_filter( 'pods_code_field_sanitize_allowed_html', $callback );
+
+		$this->assertStringContainsString( 'example.com/widget.js', $output );
+	}
+}
diff --git a/tests/codeception/wpunit/Pods/Field/PodsField_CodeTest.php b/tests/codeception/wpunit/Pods/Field/PodsField_CodeTest.php
new file mode 100644
index 0000000000..0cd0283c96
--- /dev/null
+++ b/tests/codeception/wpunit/Pods/Field/PodsField_CodeTest.php
@@ -0,0 +1,135 @@
+<?php
+
+namespace Pods_Unit_Tests\Pods\Field;
+
+use PodsField_Code;
+use Pods_Unit_Tests\Pods_UnitTestCase;
+
+/**
+ * @group              pods-field
+ * @coversDefaultClass PodsField_Code
+ */
+class PodsField_CodeTest extends Pods_UnitTestCase {
+
+	/**
+	 * @var PodsField_Code
+	 */
+	private $field;
+
+	public function setUp(): void {
+		$this->field = new PodsField_Code();
+
+		// Make sure no leftover shortcode from prior runs.
+		if ( shortcode_exists( 'pods_code_test' ) ) {
+			remove_shortcode( 'pods_code_test' );
+		}
+	}
+
+	public function tearDown(): void {
+		if ( shortcode_exists( 'pods_code_test' ) ) {
+			remove_shortcode( 'pods_code_test' );
+		}
+
+		unset( $this->field );
+	}
+
+	/**
+	 * @covers PodsField_Code::display
+	 */
+	public function test_display_preserves_external_script_src() {
+		$value = '<script src="https://example.com/widget.js"></script>';
+
+		$output = $this->field->display(
+			$value,
+			'code_field',
+			[ 'code_sanitize_html' => 1 ],
+			null,
+			0
+		);
+
+		$this->assertIsString( $output );
+		$this->assertStringContainsString( '<script', $output );
+		$this->assertStringContainsString( 'src="https://example.com/widget.js"', $output );
+	}
+
+	/**
+	 * @covers PodsField_Code::display
+	 */
+	public function test_display_preserves_iframe_src_with_dimensions() {
+		$value = '<iframe src="https://www.youtube.com/embed/abc123" width="560" height="315" frameborder="0" allowfullscreen></iframe>';
+
+		$output = $this->field->display(
+			$value,
+			'code_field',
+			[ 'code_sanitize_html' => 1 ],
+			null,
+			0
+		);
+
+		$this->assertStringContainsString( '<iframe', $output );
+		$this->assertStringContainsString( 'src="https://www.youtube.com/embed/abc123"', $output );
+		$this->assertStringContainsString( 'allowfullscreen', $output );
+	}
+
+	/**
+	 * @covers PodsField_Code::display
+	 */
+	public function test_display_runs_shortcodes_when_allowed() {
+		add_shortcode( 'pods_code_test', static function () {
+			return 'SHORTCODE_RAN';
+		} );
+
+		$output = $this->field->display(
+			'[pods_code_test]',
+			'code_field',
+			[
+				'code_sanitize_html'   => 1,
+				'code_allow_shortcode' => 1,
+			],
+			null,
+			0
+		);
+
+		$this->assertStringContainsString( 'SHORTCODE_RAN', $output );
+	}
+
+	/**
+	 * @covers PodsField_Code::display
+	 */
+	public function test_display_does_not_run_shortcodes_when_disabled() {
+		add_shortcode( 'pods_code_test', static function () {
+			return 'SHORTCODE_RAN';
+		} );
+
+		$output = $this->field->display(
+			'[pods_code_test]',
+			'code_field',
+			[
+				'code_sanitize_html'   => 1,
+				'code_allow_shortcode' => 0,
+			],
+			null,
+			0
+		);
+
+		$this->assertStringNotContainsString( 'SHORTCODE_RAN', $output );
+		$this->assertStringContainsString( '[pods_code_test]', $output );
+	}
+
+	/**
+	 * @covers PodsField_Code::display
+	 */
+	public function test_display_with_sanitize_disabled_returns_raw() {
+		$value = '<script src="https://example.com/x.js"></script>';
+
+		$output = $this->field->display(
+			$value,
+			'code_field',
+			[ 'code_sanitize_html' => 0 ],
+			null,
+			0
+		);
+
+		$this->assertSame( $value, $output );
+	}
+}