low3.5
CVE-2026-13416
The CMP WordPress plugin before 4.1.18 does not sanitise and escape a settings value before outputting it on the coming-soon page, allowing users with the Edit…
Impact
The CMP WordPress plugin before 4.1.18 does not sanitise and escape a settings value before outputting it on the coming-soon page, allowing users with the Editor role (when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls) to inject arbitrary web scripts that execute when a visitor views the page.
Affected products
| Product | Affected versions |
|---|---|
| CMP WordPress Plugin | before 4.1.18 |
Versions were read from the advisory text. No structured product data has been published for this record yet.