Search

Find a vulnerability

Search criteria

    4 vulnerabilities found for CMP by Unknown

    CVE-2026-13416 (GCVE-0-2026-13416)

    Vulnerability from cvelistv5 – Published: 2026-08-27 06:00 – Updated: 2026-08-27 06:00
    VLAI
    Title
    CMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Stored XSS via niteoCS_socialmedia
    Summary
    The CMP WordPress plugin before 4.1.18 does not sanitise and escape a settings value before outputting it on the coming-soon page, allowing users with the Editor role (when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls) to inject arbitrary web scripts that execute when a visitor views the page.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/2331d3fa-9868-43… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown CMP Affected: 0 , < 4.1.18 (semver)
    		Create a notification for this product.
    Credits
    Revanth Hari Narayana Matte WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "CMP",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "4.1.18",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Revanth Hari Narayana Matte"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The CMP  WordPress plugin before 4.1.18 does not sanitise and escape a settings value before outputting it on the coming-soon page, allowing users with the Editor role (when the administrator has granted the Editor role access to the CMP  WordPress plugin before 4.1.18\u0027s admin-bar controls) to inject arbitrary web scripts that execute when a visitor views the page."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79 Cross-Site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T06:00:16.861Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/2331d3fa-9868-4365-a7a6-52386be7f1e1/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "CMP - Coming Soon \u0026 Maintenance \u003c 4.1.18 - Editor+ Stored XSS via niteoCS_socialmedia",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-13416",
    "datePublished": "2026-08-27T06:00:16.861Z",
    "dateReserved": "2026-06-26T11:40:20.714Z",
    "dateUpdated": "2026-08-27T06:00:16.861Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-13415 (GCVE-0-2026-13415)

    Vulnerability from cvelistv5 – Published: 2026-08-27 06:00 – Updated: 2026-08-27 06:00
    VLAI
    Title
    CMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Privilege Escalation via cmp_ajax_import_settings
    Summary
    The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the Editor role (when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls) to update arbitrary WordPress options, including options that lead to privilege escalation to Administrator.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/f0380d89-6e49-46… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown CMP Affected: 0 , < 4.1.18 (semver)
    		Create a notification for this product.
    Credits
    Revanth Hari Narayana Matte WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "CMP",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "4.1.18",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Revanth Hari Narayana Matte"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The CMP  WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the Editor role (when the administrator has granted the Editor role access to the CMP  WordPress plugin before 4.1.18\u0027s admin-bar controls) to update arbitrary WordPress options, including options that lead to privilege escalation to Administrator."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T06:00:16.668Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/f0380d89-6e49-462a-b158-9d2cc3f049ca/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "CMP - Coming Soon \u0026 Maintenance \u003c 4.1.18 - Editor+ Privilege Escalation via cmp_ajax_import_settings",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-13415",
    "datePublished": "2026-08-27T06:00:16.668Z",
    "dateReserved": "2026-06-26T11:40:15.631Z",
    "dateUpdated": "2026-08-27T06:00:16.668Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-13414 (GCVE-0-2026-13414)

    Vulnerability from cvelistv5 – Published: 2026-08-27 06:00 – Updated: 2026-08-27 06:00
    VLAI
    Title
    CMP - Coming Soon & Maintenance < 4.1.18 - Unauthenticated Maintenance Mode Disable via cmp_disable_comingsoon_ajax
    Summary
    The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain (and exposed to anonymous visitors on others), allowing unauthenticated attackers to disable the site's maintenance/coming-soon mode under a non-default countdown configuration.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/096f11ce-060a-40… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown CMP Affected: 0 , < 4.1.18 (semver)
    		Create a notification for this product.
    Credits
    Revanth Hari Narayana Matte WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "CMP",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "4.1.18",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Revanth Hari Narayana Matte"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The CMP  WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain  (and exposed to anonymous visitors on others), allowing unauthenticated attackers to disable the site\u0027s maintenance/coming-soon mode under a non-default countdown configuration."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T06:00:16.494Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/096f11ce-060a-403a-8af0-ae2ee7676318/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "CMP - Coming Soon \u0026 Maintenance \u003c 4.1.18 - Unauthenticated Maintenance Mode Disable via cmp_disable_comingsoon_ajax",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-13414",
    "datePublished": "2026-08-27T06:00:16.494Z",
    "dateReserved": "2026-06-26T11:40:13.723Z",
    "dateUpdated": "2026-08-27T06:00:16.494Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2022-0188 (GCVE-0-2022-0188)

    Vulnerability from cvelistv5 – Published: 2022-02-14 09:20 – Updated: 2024-08-02 23:18
    VLAI
    Title
    Coming Soon & Maintenance Plugin by NiteoThemes < 4.0.19 - Unauthenticated Arbitrary CSS Update
    Summary
    The CMP WordPress plugin before 4.0.19 allows any user, even not logged in, to arbitrarily change the coming soon page layout.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    Unknown CMP Affected: 0 , < 4.0.19 (custom)
    		Create a notification for this product.
    Credits
    Krzysztof Zając WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:18:42.518Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "exploit",
              "vdb-entry",
              "technical-description",
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/50b6f770-6f53-41ef-b2f3-2a58e9afd332"
          },
          {
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/changeset/2657597/cmp-coming-soon-maintenance"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "product": "CMP",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "4.0.19",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Krzysztof Zaj\u0105c"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The CMP WordPress plugin before 4.0.19 allows any user, even not logged in, to arbitrarily change the coming soon page layout."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-306 Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-07-04T07:45:47.294Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/50b6f770-6f53-41ef-b2f3-2a58e9afd332"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://plugins.trac.wordpress.org/changeset/2657597/cmp-coming-soon-maintenance"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Coming Soon \u0026 Maintenance Plugin by NiteoThemes \u003c 4.0.19 - Unauthenticated Arbitrary CSS Update",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2022-0188",
    "datePublished": "2022-02-14T09:20:58.000Z",
    "dateReserved": "2022-01-11T00:00:00.000Z",
    "dateUpdated": "2024-08-02T23:18:42.518Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}