The Pinterest Site Verification plugin using Meta Tag for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input in the 'post_var' parameter. Authenticated users with subscriber-level privileges or higher can inject malicious scripts that persist and execute in the context of other users viewing the infected pages. This vulnerability affects all versions up to and including 1.8. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges, no user interaction, and impacts confidentiality and integrity with scope changed. No vendor-provided patch or remediation is currently documented.

Successful exploitation allows an authenticated user with subscriber-level access or higher to inject and execute arbitrary JavaScript code in the context of other users visiting the affected pages. This can lead to partial confidentiality and integrity compromise of user data within the affected WordPress site. There is no impact on availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level user privileges where possible and monitor for suspicious activity related to the plugin. Consider disabling or removing the Pinterest Site Verification plugin if it is not essential to reduce exposure.