CVE-2026-13416: CMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Stored XSS via niteoCS_socialmedia
The CMP WordPress plugin before 4.1.18 does not sanitise and escape a settings value before outputting it on the coming-soon page, allowing users with the Editor role (when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls) to inject arbitrary web scripts that execute when a visitor views the page.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A user with the WordPress Editor role can exploit it only if an administrator has granted Editors access to the CMP plugin's admin-bar controls.
Who is exposed to the injected script?
Any visitor who views the affected coming-soon page can have the injected web script execute in their browser.
Which versions are affected?
CMP versions before 4.1.18 are affected. Updating to version 4.1.18 or later addresses the vulnerable handling of the settings value.
What can be done before updating?
Remove Editor access to CMP's admin-bar controls and review the relevant CMP settings value for untrusted script content. Restricting that access prevents Editors from using this described attack path.