CVE-2026-13416 Overview
CVE-2026-13416 is a stored Cross-Site Scripting (XSS) vulnerability in the CMP (Coming Soon & Maintenance Page) WordPress plugin versions before 4.1.18. The plugin fails to sanitize and escape a settings value before rendering it on the coming-soon page. Users assigned the Editor role can inject arbitrary JavaScript that executes in the browser of any visitor viewing the affected page. Exploitation requires that an administrator has granted the Editor role access to the plugin's admin-bar controls.
Critical Impact
Authenticated Editors can persistently store JavaScript payloads that execute against every visitor to the coming-soon page, enabling session theft, credential harvesting, and administrator account takeover.
Affected Products
- CMP WordPress plugin versions prior to 4.1.18
- WordPress sites where administrators have delegated CMP admin-bar controls to Editor-role users
- Public-facing coming-soon or maintenance pages generated by the plugin
Discovery Timeline
- 2026-08-27 - CVE-2026-13416 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-13416
Vulnerability Analysis
The vulnerability is a stored Cross-Site Scripting flaw [CWE-79] in the CMP plugin's settings handling. The plugin persists a settings value supplied through its admin-bar controls and later outputs that value on the public coming-soon page. Because the output routine omits sanitization on write and escaping on read, an attacker-controlled string is rendered as HTML rather than as literal text.
An Editor with delegated CMP access supplies a payload containing script markup or event handlers through the setting. The payload is written to the WordPress options table and rendered to every visitor of the coming-soon page. The script executes in the visitor's browser under the site origin.
Root Cause
The root cause is missing input sanitization and missing output escaping around a plugin settings field. WordPress provides sanitize_text_field() for input and esc_html() or esc_attr() for output, but the affected code path invokes neither before emitting the stored value in HTML context.
Attack Vector
Exploitation requires an authenticated Editor account and an administrator configuration that grants Editors access to CMP admin-bar controls. The attacker submits a malicious payload through the settings interface. The payload persists until an administrator removes it. Any unauthenticated visitor to the coming-soon page triggers execution, so a single injection reaches all site visitors, including administrators who preview the page.
See the WPScan Vulnerability Report for additional technical detail.
Detection Methods for CVE-2026-13416
Indicators of Compromise
- Unexpected <script> tags, on* event handlers, or javascript: URIs stored in CMP-related rows of the wp_options table.
- Outbound requests from visitor browsers to unknown domains when loading the coming-soon page.
- Newly created administrator accounts or modified user roles following visits by privileged users.
Detection Strategies
- Audit the wp_options table for CMP plugin settings values containing HTML or JavaScript syntax.
- Review WordPress activity logs for setting changes made by Editor-role accounts against CMP options.
- Scan the rendered coming-soon page HTML for inline scripts that do not originate from the plugin's own assets.
Monitoring Recommendations
- Alert on any modification to CMP plugin options by non-administrator accounts.
- Monitor web server access logs for anomalous responses from the coming-soon endpoint referencing external script sources.
- Track Editor-role logins followed by plugin settings changes and correlate with visitor-side JavaScript errors.
How to Mitigate CVE-2026-13416
Immediate Actions Required
- Update the CMP WordPress plugin to version 4.1.18 or later on all affected sites.
- Revoke Editor-role access to CMP admin-bar controls until the patch is applied.
- Inspect current CMP settings for injected script content and remove any suspicious values.
Patch Information
The vendor addressed the flaw in CMP WordPress plugin version 4.1.18 by adding sanitization and output escaping to the affected settings value. Upgrade through the WordPress plugin manager or by replacing the plugin directory with the fixed release. Consult the WPScan Vulnerability Report for the fixed version reference.
Workarounds
- Restrict CMP admin-bar controls to administrator accounts only until patching is complete.
- Temporarily disable the CMP plugin if the coming-soon page is not currently required.
- Force a password reset for administrator accounts that previewed the coming-soon page while a malicious payload may have been active.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
