Arbitrary Web Script Injection Vulnerability in CMP Plugin for WordPress
CVE-2026-13416
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-13416?
The CMP WordPress plugin prior to version 4.1.18 lacks adequate sanitization and escaping of settings values. This flaw permits users assigned the Editor role, if granted access to the admin-bar controls of the plugin, to inject malicious web scripts. These scripts can execute when a visitor views the coming-soon page, potentially compromising the site's security and integrity.
Affected Version(s)
CMP 0 < 4.1.18
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.