Executive brief
CMP is a WordPress plugin that creates coming-soon and maintenance pages for websites. The plugin fails to properly sanitize social media configuration settings before displaying them on the public coming-soon page. An attacker with Editor role access can inject malicious JavaScript code that executes automatically in the browsers of all visitors viewing the coming-soon page, potentially stealing credentials or redirecting users.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the CMP WordPress plugin's social media settings handler. The vulnerability exists in the niteoCS_socialmedia settings parameter, which is not properly escaped when rendered in the coming-soon page HTML. An authenticated attacker with Editor role (when the administrator grants Editor access to CMP admin-bar controls) can exploit the cmp_ajax_import_settings AJAX endpoint to inject arbitrary HTML/JavaScript that persists in the plugin's options. The payload executes automatically on the public coming-soon page for all anonymous visitors without requiring user interaction. The vulnerability affects versions before 4.1.18 when using specific themes (countdown, construct, or hardwork) and has been fixed in version 4.1.18.
Affected products
- Niteo CMP - Coming Soon & Maintenance before 4.1.18
Timeline
- 2026-08-25: disclosed
- 2026-08-27: patched: Fixed in version 4.1.18