The Pinterest Verify Meta Tag plugin for WordPress contains an improper neutralization of input during page generation, allowing attackers to embed malicious scripts that are stored and served to all site visitors. This stored cross‑site scripting flaw could let an attacker compromise user sessions, deface content, or exfiltrate sensitive data. The weakness stems from unchecked input, classified as CWE‑79, and enables the injection of arbitrary JavaScript that executes in the context of the site.

Any WordPress installation running Marvie Pons Pinterest Verify Meta Tag plugin version 1.3 or earlier is affected. The plugin, a popular tool for embedding Pinterest verification metadata, is distributed under the name Pinterest Verify Meta Tag. Vulnerable versions include all releases from the initial release up to and including 1.3.

The CVSS score of 5.9 indicates moderate severity, and the EPSS score of less than 1% suggests a very low current risk of exploitation. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. The attack vector is likely through the plugin’s administration interface or any exposed configuration endpoint, where an attacker can submit malicious payloads that the plugin fails to sanitize. Once stored, the payload is delivered to all users visiting the affected pages, enabling script execution on the client side.