CVE-2026-13416

Name of the Vulnerable Software and Affected Versions CMP WordPress plugin versions prior to 4.1.18

Description Insufficient sanitization and escaping of a settings value before it is output on the coming-soon page allows users with the Editor role to perform a Cross-Site Scripting (XSS) attack. This occurs when the administrator has granted the Editor role access to the plugin's admin-bar controls, enabling the injection of arbitrary web scripts that execute when a visitor views the page.

Recommendations Update CMP WordPress plugin to version 4.1.18 or later.