Junglewise Threat Intelligence

CVE-2026-3142: WordPress Pinterest Site Verification Stored XSS in post_var

CVE-2026-3142 · Severity: medium · CVSS 6.4 · Published 2026-04-08

Executive brief

The Pinterest Site Verification plugin for WordPress, which helps website owners verify their site ownership with Pinterest, contains a security flaw. An attacker with a basic user account (such as a subscriber) can inject malicious scripts into the website. These scripts will run automatically in the browsers of other visitors, potentially leading to unauthorized actions or the theft of sensitive information.

Technical details

The Pinterest Site Verification plugin using Meta Tag for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'post_var' parameter. This vulnerability allows authenticated attackers with subscriber-level permissions or higher to inject arbitrary web scripts into the database. These scripts are then executed in the context of a user's browser session whenever they visit the affected page. The flaw is present in versions up to and including 1.8. The attack vector is network-based and requires low-level authentication but no user interaction to trigger the stored script.

Affected products

  • uniquecodergmailcom Pinterest Site Verification plugin using Meta Tag up to, and including, 1.8

Timeline

  • 2026-04-08: disclosed: Initial publication of the vulnerability advisory.

References