Description

The CMP WordPress plugin before 4.1.18 does not sanitise and escape a settings value before outputting it on the coming-soon page, allowing users with the Editor role (when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls) to inject arbitrary web scripts that execute when a visitor views the page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-08-27T06:16:55.723Z",
  "pubdate": "2026-08-27T06:16:55.723Z",
  "executiveSummary": "The CMP WordPress plugin, in versions prior to 4.1.18, contains a Stored Cross-Site Scripting (XSS) vulnerability due to insufficient input validation and output encoding of plugin settings.\nThe vulnerability allows an authenticated user with the Editor role, who has been granted administrative access to plugin controls, to inject arbitrary JavaScript payloads into the plugin configuration.\nWhen a visitor views the 'coming-soon' page where these settings are rendered, the malicious script executes within the context of the visitor's browser.\nThis flaw compromises the integrity of the visitor session, potentially enabling session hijacking, redirection to malicious domains, or unauthorized actions performed on behalf of the victim.\nThe attack requires an attacker to possess existing administrative-level access to the plugin settings, representing a privilege escalation vector within the WordPress application architecture.",
  "technicalDetails": "The vulnerability originates from the failure of the CMP plugin to sanitize input and escape output for specific settings fields before they are rendered on the frontend 'coming-soon' page.\nIn versions prior to 4.1.18, the plugin handles user-supplied data in the administrative settings panel without applying rigorous filtering mechanisms such as WordPress's built-in sanitize_text_field() or esc_html() functions.\nBecause the plugin allows users with the 'Editor' role—specifically those granted access to the CMP admin-bar controls by an administrator—to modify these settings, the application improperly trusts data stored in the database.\nThe attack flow begins with the authenticated Editor navigating to the CMP plugin settings panel. Within a vulnerable settings field, the attacker injects a crafted payload containing script tags (e.g., <script>alert('XSS')</script>).\nOnce saved, the plugin stores this malicious string in the WordPress options table. When a frontend visitor requests the coming-soon page, the plugin retrieves the unsanitized value from the database and injects it directly into the HTML document object model (DOM) without prior escaping.\nThe browser interprets this injected payload as legitimate executable content, leading to the execution of the attacker's JavaScript. This occurs in the context of the site's origin, allowing the payload to access cookies, localStorage, and perform arbitrary DOM manipulation.\nThis vulnerability is classified as Stored XSS because the malicious payload is persisted on the server, ensuring execution whenever the page is rendered for any visitor.\nPost-exploitation impact includes the potential for full session compromise of administrative users if they view the infected page while logged in, as well as the ability for attackers to conduct phishing or defacement operations targeting site visitors."
}