PT-2025-38911 · Codefish · Pinterest Pinboard Widget

Published 2025-09-22 · Updated 2025-09-23 · CVE-2025-58248

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions codefish Pinterest Pinboard Widget versions through 1.0.7

Description The codefish Pinterest Pinboard Widget contains a flaw related to improper input handling during web page generation, which allows for Stored Cross-site Scripting (XSS). This can potentially lead to the execution of malicious scripts in the context of a user's browser. The vulnerability exists due to insufficient sanitization of user-supplied input before it is incorporated into the web page. The affected component is susceptible to attacks where an attacker injects malicious code into the application, which is then stored and served to other users.

Recommendations Update codefish Pinterest Pinboard Widget to a version later than 1.0.7.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-58248

Affected Products

Pinterest Pinboard Widget

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-58248 · Security Note
• https://patchstack.com/database/wordpress/plugin/pinterest-pinboard-widget/vulnerability/wordpress-pinterest-pinboard-widget-plugin-1-0-7-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1970393486626091225 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/pinterest-pinboard-widget/vulnerability/wordpress-pinterest-pinboard-widget-plugin-1-0-7-cross-site-scripting-xss-vulnerability?_s_id=cve · Note