Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · cmp-coming-soon-maintenance
CMP
13 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 21, 2026CMP – Coming Soon & Maintenance: Does not correctly apply maintenance mode to pages added to its page whitelist by manually entered URL patternCVE-2026-101138 · fixed in 4.1.21 · reported by WPScanMedium 5.3
The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.21 does not correctly apply maintenance mode to pages added to its page whitelist by manually entered URL pattern, allowing unauthenticated visitors to view the content of those pages while maintenance mode is active.
Oct 2, 2026CMP – Coming Soon & Maintenance: Does not correctly restrict access to the site while maintenance/coming-soon mode is enabledCVE-2026-13413 · fixed in 4.1.20 · reported by WPScanMedium 5.3
The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.20 does not correctly restrict access to the site while maintenance/coming-soon mode is enabled, allowing unauthenticated visitors to bypass the coming-soon page and reach the otherwise hidden site, including hidden published pages, by shaping the request so it is mistaken for a login request.
Sep 22, 2026CMP – Coming Soon & Maintenance Plugin by NiteoThemes: Unauthorized modification of data that can lead to privilege escalationCVE-2026-12470 · affects up to 4.1.17 · reported by WordfenceHigh 7.2
The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'cmp_ajax_import_settings' AJAX action in all versions up to, and including, 4.1.17. This makes it possible for authenticated attackers, with Editor-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 27, 2026CMP: Does not sanitise and escape a settings value before outputting it on the coming-soon pageCVE-2026-13416 · fixed in 4.1.18 · reported by WPScanLow 3.5
The CMP WordPress plugin before 4.1.18 does not sanitise and escape a settings value before outputting it on the coming-soon page, allowing users with the Editor role (when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls) to inject arbitrary web scripts that execute when a visitor views the page.
Aug 27, 2026CMP: Does not enforce an option-name allow-listCVE-2026-13415 · fixed in 4.1.18 · reported by WPScanHigh 7.2
The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the Editor role (when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls) to update arbitrary WordPress options, including options that lead to privilege escalation to Administrator.
Aug 27, 2026CMP: Does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain (and exposed to anonymous visitors on others)CVE-2026-13414 · fixed in 4.1.18 · reported by WPScanMedium 4.8
The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain (and exposed to anonymous visitors on others), allowing unauthenticated attackers to disable the site's maintenance/coming-soon mode under a non-default countdown configuration.
Apr 18, 2026CMP – Coming Soon & Maintenance Plugin by NiteoThemes: Arbitrary file upload and remote code executionCVE-2026-6518 · affects up to 4.1.16 · reported by WordfenceHigh 8.8
The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to arbitrary file upload and remote code execution in all versions up to, and including, 4.1.16 via the `cmp_theme_update_install` AJAX action. This is due to the function only checking for the `publish_pages` capability (available to Editors and above) instead of `manage_options` (Administrators only), combined with a lack of proper validation on the user-supplied file URL and no verification of the downloaded file's content before extraction. This makes it possible for authenticated attackers, with Administrator-level access and above, to force the server to download and extract a malicious ZIP file from a remote attacker-controlled URL into a web-accessible directory (`wp-content/plugins/cmp-premium-themes/`), resulting in remote code execution. Due to the lack of a nonce for Editors, they are unable to exploit this vulnerability.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 4, 2025CMP – Coming Soon & Maintenance: Unrestricted Upload of File with Dangerous TypeCVE-2025-32118 · affects up to 4.1.14 · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in NiteoThemes CMP – Coming Soon & Maintenance cmp-coming-soon-maintenance allows Using Malicious Files.This issue affects CMP – Coming Soon & Maintenance: from n/a through <= 4.1.14.
Mar 28, 2024CMP – Coming Soon & Maintenance: Server-Side Request Forgery (SSRF)CVE-2023-50374 · affects up to 4.1.10 · reported by PatchstackMedium 5.5
Server-Side Request Forgery (SSRF) vulnerability in NiteoThemes CMP – Coming Soon & Maintenance.This issue affects CMP – Coming Soon & Maintenance: from n/a through 4.1.10.
Jun 9, 2023CMP – Coming Soon & Maintenance: Maintenance Mode BypassCVE-2023-2159 · affects up to 4.1.7 · reported by WordfenceMedium 5.3
The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to Maintenance Mode Bypass in versions up to, and including, 4.1.7. A correct cmp_bypass GET parameter in the URL (equal to the md5-hashed home_url in the default setting) allows users to visit a site placed in maintenance mode thus bypassing the plugin's provided feature.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 6, 2023CMP: Authorization bypassCVE-2020-36730 · affects up to 3.8.1 · reported by WordfenceHigh 8.3
The CMP for WordPress is vulnerable to authorization bypass due to a missing capability check on the cmp_get_post_detail(), niteo_export_csv(), and cmp_disable_comingsoon_ajax() functions in versions up to, and including, 3.8.1. This makes it possible for unauthenticated attackers to read posts, export subscriber lists, and/or deactivate the plugin.
Mar 7, 2023CMP – Coming Soon & Maintenance: Information ExposureCVE-2023-1263 · affects up to 4.1.6 · reported by WordfenceMedium 5.3
The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 4.1.6 via the cmp_get_post_detail function. This can allow unauthenticated individuals to obtain the contents of any non-password-protected, published post or page even when maintenance mode is enabled.
Feb 14, 2022CMP: Allows any userCVE-2022-0188 · fixed in 4.0.19 · reported by WPScanMedium 5.3
The CMP WordPress plugin before 4.0.19 allows any user, even not logged in, to arbitrarily change the coming soon page layout.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.