CVE-2026-13416 in CMP Plugin
Summary
by MITRE • 08/27/2026
The CMP WordPress plugin before 4.1.18 does not sanitise and escape a settings value before outputting it on the coming-soon page, allowing users with the Editor role (when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls) to inject arbitrary web scripts that execute when a visitor views the page.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified in versions of the Contact Form Manager (CMP) WordPress plugin prior to version 4.1.18 represents a classic instance of Cross-Site Scripting, specifically categorized under CWE-79: Improper Neutralization of Input During Web Page Generation. This flaw stems from an insufficient sanitization and escaping mechanism applied to user-controllable settings values before they are rendered on the coming-soon page. In secure web application development, any data originating from a database or user input that is subsequently displayed in a browser context must be rigorously validated against expected formats and encoded using appropriate output encoding techniques such as HTML entity encoding. The absence of these safeguards allows malicious actors to inject executable JavaScript code directly into the page content, which browsers then interpret and execute within the security context of the website.
The operational impact of this vulnerability is significant because it enables attackers to compromise the integrity and confidentiality of the web application for its visitors. When a user with the Editor role accesses the plugin's admin-bar controls, they are granted sufficient privileges to modify specific settings values. If an attacker has obtained or compromised credentials for an account possessing these elevated permissions, they can manipulate the incoming-soon page configuration to include malicious scripts. These scripts execute in the context of any visitor who views the affected page, potentially leading to session hijacking through cookie theft, defacement of the website content, redirection to phishing sites, or further exploitation via drive-by downloads. This effectively turns a standard administrative feature into an attack vector against end-users interacting with the site.
From a threat modeling perspective aligned with the MITRE ATT&CK framework, this vulnerability facilitates techniques associated with Client-Side Code Injection and potentially Credential Access through Browser Session Hijacking. The attacker leverages valid user credentials to perform actions that alter application state in a way that impacts other users. This is particularly dangerous because it exploits trust relationships between the browser and the website, as well as within the administrative hierarchy of the WordPress installation. The vulnerability highlights the critical importance of implementing strict role-based access control alongside robust input validation and output encoding practices across all plugin functionalities, especially those affecting public-facing pages like coming-soon screens which are often visited by a broad audience before a site goes live or during maintenance periods.
To mitigate this risk, immediate action is required to update the CMP WordPress plugin to version 4.1.18 or later where these sanitization and escaping mechanisms have been properly implemented. In addition to updating software, administrators should adhere to the principle of least privilege by ensuring that only necessary users are granted access to administrative controls within plugins. It is also advisable to implement a Web Application Firewall configured with rules capable of detecting and blocking common Cross-Site Scripting payloads in HTTP requests. Furthermore, developers must ensure that all future updates undergo rigorous security testing focused on input validation and output encoding compliance with OWASP guidelines to prevent similar vulnerabilities from being introduced into the application codebase.