What is the CVSS score of CVE-2026-3142?

CVE-2026-3142 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-3142

EUVD-2026-20101 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-08 Wordfence

GHSA-3563-xg9w-653g

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 07:00 euvd

EUVD-2026-20101

Analysis Generated

Apr 08, 2026 - 07:00 vuln.today

CVE Published

Apr 08, 2026 - 06:43 nvd

MEDIUM 6.4

DescriptionCVE.org

The Pinterest Site Verification plugin using Meta Tag plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_var' parameter in versions up to, and including, 1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in Pinterest Site Verification Plugin Using Meta Tag for WordPress up to version 1.8 allows authenticated attackers with subscriber-level access to inject arbitrary JavaScript via the 'post_var' parameter due to insufficient input sanitization and output escaping. The vulnerability has a CVSS score of 6.4 with cross-site scope, enabling persistent script injection that executes in the browsers of any user visiting affected pages. No public exploit code or active exploitation has been confirmed at the time of analysis.

Technical ContextAI

The Pinterest Site Verification Plugin Using Meta Tag (CPE: cpe:2.3:a:uniquecodergmailcom:pinterest_site_verification_plugin_using_meta_tag:*:*:*:*:*:*:*:*) is a WordPress plugin that manages Pinterest meta tag verification. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a stored XSS weakness. The plugin fails to properly sanitize user input from the 'post_var' parameter and does not adequately escape output when rendering page content. Code review references point to multiple locations in PinterestMetaTagSiteVerification.php (lines 92, 132, 160, 172, 180, and 214) where insufficient escaping occurs, allowing attacker-controlled data to be reflected as executable JavaScript within the WordPress page DOM.

RemediationAI

Update the Pinterest Site Verification Plugin Using Meta Tag to a patched version released after 1.8. Site administrators should access the WordPress plugin dashboard, navigate to installed plugins, and upgrade to the latest available version of the Pinterest Site Verification Plugin Using Meta Tag. Until an update is available, restrict subscriber-level user creation and review existing subscriber accounts for suspicious activity. Wordfence customers receive automatic threat intelligence updates. For detailed remediation guidance and to verify patch availability, consult the official Wordfence vulnerability report at https://www.wordfence.com/threat-intel/vulnerabilities/id/7ccb7534-b588-4bdd-9627-0e38c0ee5e8a?source=cve and monitor the WordPress plugin repository at plugins.trac.wordpress.org/browser/pinterest-site-verification/.