Nixpkgs security tracker

Login with GitHub
⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Suggestion detail

Untriaged
Permalink CVE-2026-13416
3.5 LOW
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): High (H)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): High (H)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
created 1 day, 15 hours ago Activity log
  • Created suggestion 1 day, 15 hours ago
CMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Stored XSS via niteoCS_socialmedia

The CMP WordPress plugin before 4.1.18 does not sanitise and escape a settings value before outputting it on the coming-soon page, allowing users with the Editor role (when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls) to inject arbitrary web scripts that execute when a visitor views the page.

References

Affected products

CMP
  • <4.1.18

Matching in nixpkgs

pkgs.cmph

Free minimal perfect hash C library, providing several algorithms in the literature in a consistent, ease to use, API

pkgs.dtcmp

MPI datatype comparison library

pkgs.ncmpc

Curses-based interface for MPD (music player daemon)

  • nixos-unstable 0.52
    • nixpkgs-unstable 0.52
    • nixos-unstable-small 0.54
  • nixos-26.05 0.52
    • nixos-26.05-small 0.52
    • nixpkgs-26.05-darwin 0.52

pkgs.rnxcmp

Compression/restoration of RINEX observation files developed by Y. Hatanaka of GSI

pkgs.critcmp

Command line tool for comparing benchmarks run by Criterion

pkgs.fstrcmp

Make fuzzy comparisons of strings and byte arrays

  • nixos-unstable 0.7
    • nixpkgs-unstable 0.7
    • nixos-unstable-small 0.7
  • nixos-26.05 0.7
    • nixos-26.05-small 0.7
    • nixpkgs-26.05-darwin 0.7

pkgs.scmpuff

Numeric file shortcuts for common git commands

pkgs.luaPackages.nvim-cmp

A completion plugin for neovim

  • nixos-unstable 1
    • nixpkgs-unstable 1
    • nixos-unstable-small 1
  • nixos-26.05 1
    • nixos-26.05-small 1
    • nixpkgs-26.05-darwin 1

pkgs.haskellPackages.funcmp

Functional MetaPost is a Haskell frontend to the MetaPost language

  • nixos-unstable 1.9
    • nixpkgs-unstable 1.9
    • nixos-unstable-small 1.9
  • nixos-26.05 1.9
    • nixos-26.05-small 1.9
    • nixpkgs-26.05-darwin 1.9

pkgs.lua51Packages.nvim-cmp

A completion plugin for neovim

  • nixos-unstable 1
    • nixpkgs-unstable 1
    • nixos-unstable-small 1
  • nixos-26.05 1
    • nixos-26.05-small 1
    • nixpkgs-26.05-darwin 1

pkgs.lua52Packages.nvim-cmp

A completion plugin for neovim

  • nixos-unstable 1
    • nixpkgs-unstable 1
    • nixos-unstable-small 1
  • nixos-26.05 1
    • nixos-26.05-small 1
    • nixpkgs-26.05-darwin 1

pkgs.lua53Packages.nvim-cmp

A completion plugin for neovim

  • nixos-unstable 1
    • nixpkgs-unstable 1
    • nixos-unstable-small 1
  • nixos-26.05 1
    • nixos-26.05-small 1
    • nixpkgs-26.05-darwin 1

pkgs.luajitPackages.nvim-cmp

A completion plugin for neovim

  • nixos-unstable 1
    • nixpkgs-unstable 1
    • nixos-unstable-small 1
  • nixos-26.05 1
    • nixos-26.05-small 1
    • nixpkgs-26.05-darwin 1