CVE-2026-3142

The Pinterest Site Verification plugin using Meta Tag plugin for WordPress versions 1.8 and earlier contains a stored cross-site scripting vulnerability in the 'post_var' parameter caused by insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level privileges or higher can inject arbitrary web scripts into pages that execute when users access affected content. The vulnerability presents medium severity with a CVSS score of 6.4. The attack requires network access but involves low complexity and no user interaction beyond normal site access. It can result in limited confidentiality and integrity impact across multiple security scopes, though availability is not affected. Currently, there is no evidence of active exploitation in the wild. The vulnerability has not been added to the Known Exploited Vulnerabilities catalog, and the EPSS score of 0.00047 indicates extremely low probability of exploitation in the next 30 days. Community attention remains minimal given the low-risk profile and lack of readily available exploit code.