Quick answers
- Is CVE-2026-13416 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-13416 being exploited in the wild.
- How severe is CVE-2026-13416?
- Low severity, with a CVSS score of 3.5, published 27 August 2026.
- Which products and versions are affected?
- Niteo CMP - Coming Soon & Maintenance before 4.1.18.
- Is there a fix for CVE-2026-13416?
- A patch was published on 2026-08-27: Fixed in version 4.1.18 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-13416 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-13416?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the CMP WordPress plugin's social media settings handler. The vulnerability exists in the niteoCS_socialmedia settings parameter, which is not properly escaped when rendered in the coming-soon page HTML. An authenticated attacker with Editor role (when the administrator grants Editor access to CMP admin-bar controls) can exploit the cmp_ajax_import_settings AJAX endpoint to inject arbitrary HTML/JavaScript that persists in the plugin's options. The payload executes automatically on the public coming-soon page for all anonymous visitors without requiring user interaction. The vulnerability affects versions before 4.1.18 when using specific themes (countdown, construct, or hardwork) and has been fixed in version 4.1.18.
Affected products
- Niteo CMP - Coming Soon & Maintenance before 4.1.18
Timeline
- 2026-08-25: disclosed
- 2026-08-27: patched: Fixed in version 4.1.18