Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: CMP 4.1.18 Clear all filters
TI-2026-11359 CVE-2026-13416 · GHSA-5f7p-rffr-5php

CMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Stored XSS via niteoCS_socialmedia

Priority LOW 16

The CMP WordPress plugin before 4.1.18 does not sanitise and escape a settings value before outputting it on the coming-soon page, allowing users with the Editor role (when the administrator has granted the Editor role a…

CVSS 3.1LOW 3.5 Network High privileges User interaction EPSS 0.00242 Published 2026-08-27 Fixed in 4.1.18 CWE-79
TI-2026-11358 CVE-2026-13415 · GHSA-4753-4c7m-r6px

CMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Privilege Escalation via cmp_ajax_import_settings

Priority LOW 34

The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the Editor role (when the administrator has granted the Editor ro…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00462 Published 2026-08-27 Fixed in 4.1.18 CWE-269
TI-2026-11357 CVE-2026-13414 · GHSA-6c47-jwpm-32qx

CMP - Coming Soon & Maintenance < 4.1.18 - Unauthenticated Maintenance Mode Disable via cmp_disable_comingsoon_ajax

Priority LOW 21

The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain (and exposed to anonymous visitors on others), allowing unauthenti…

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00223 Published 2026-08-27 Fixed in 4.1.18 CWE-862