CVE-2026-13416
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The CMP WordPress plugin before version 4.1.18 does not sanitise and escape a settings value before outputting it on the coming-soon page, allowing users with the Editor role (when the administrator has granted the Editor role access to the CMP plugin's admin-bar controls) to inject arbitrary web scripts that execute when a visitor views the page.
Risk Assessment
An attacker with the Editor role can inject malicious scripts that execute in the browser of visitors to the coming-soon page, potentially leading to session theft, phishing, or malware distribution.
Recommendation
It is recommended to update the CMP plugin to version 4.1.18 or later and restrict access to admin-bar controls to trusted users only.
Other vulnerabilities in CMP WordPress plugin
See all- CVE-2026-13415High
The CMP WordPress plugin before version 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the Editor role (when the administrator has granted the Editor role access to the CMP plugin's admin-bar controls) to update arbitrary WordPress options, including options that lead to privilege escalation to Administrator.
- CVE-2026-13414Medium
The CMP WordPress plugin before version 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain (and exposed to anonymous visitors on others), allowing unauthenticated attackers to disable the site's maintenance/coming-soon mode under a non-default countdown configuration.
Original NVD description (English source)
The CMP WordPress plugin before 4.1.18 does not sanitise and escape a settings value before outputting it on the coming-soon page, allowing users with the Editor role (when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls) to inject arbitrary web scripts that execute when a visitor views the page.