The CMP WordPress plugin earlier than version 4.1.18 does not sanitize a settings value that is displayed on the Coming‑Soon page. An Editor‑role user who has been granted permission to edit the plugin can embed arbitrary JavaScript into that value. When any visitor loads the Coming‑Soon page, the stored script runs in the visitor’s browser context.

All WordPress installations that have the CMP plugin installed in a version older than 4.1.18 and that allow Editor‑role users to access the plugin’s settings via the admin‑bar are affected. The vulnerability is independent of other plugins or themes.

The CVSS score of 3.5 indicates a low severity. The EPSS score of less than 1% indicates a very low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that an Editor with permission inject the malicious payload; the attacker’s impact is limited to the code execution of that script when visitors view the Coming‑Soon page.