CVE-2026-3142 is a stored cross-site scripting vulnerability in the Pinterest Site Verification plugin using Meta Tag for WordPress, affecting versions up to and including 1.8. The vulnerability is due to improper neutralization of input in the 'post_var' parameter, allowing authenticated users with subscriber-level privileges or higher to inject arbitrary web scripts. These scripts execute when any user accesses the injected page, potentially compromising confidentiality and integrity. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges at the level of a subscriber, no user interaction, and partial impact on confidentiality and integrity but no impact on availability. No vendor-provided patch or official remediation is currently documented.

An attacker with subscriber-level access can store malicious scripts via the vulnerable parameter, which execute in the context of other users visiting the affected pages. This can lead to partial disclosure of information and modification of data accessible to the victim user. There is no impact on system availability. The vulnerability does not require user interaction for exploitation but does require authenticated access at subscriber level or above. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access to trusted users only and consider disabling or removing the affected plugin if possible. Monitor for updates from the vendor or security advisories for a patch or mitigation instructions.