CVE-2026-13416: CWE-79 Cross-Site Scripting (XSS) in CMP

CVE-2026-13416 is a CWE-79 Cross-Site Scripting vulnerability in the CMP WordPress plugin versions prior to 4.1.18. The vulnerability occurs due to improper sanitization and escaping of a settings value output on the coming-soon page. Exploitation requires that an administrator has granted the Editor role access to the CMP plugin's admin-bar controls, enabling those users to inject arbitrary web scripts that execute in the context of visitors viewing the page.

Successful exploitation allows users with Editor role privileges to inject and execute arbitrary scripts in the browsers of visitors to the affected coming-soon page. This can lead to limited confidentiality and integrity impacts such as theft of cookies or session tokens and manipulation of page content. The CVSS score is 3.5 (low severity), reflecting that the attack requires some privileges and user interaction.

No official patch or remediation level is currently confirmed. Administrators should verify if the plugin version is earlier than 4.1.18 and consider upgrading to version 4.1.18 or later once available. Until then, restrict Editor role access to the CMP plugin's admin-bar controls to trusted users only. Monitor the vendor advisory for updates on patches or official fixes.