All the major content management frameworks offer a Software As A Service (SAAS) hosted/managed option. Since you do not actually control the server, and scripting is limited, implementing CORS may be difficult, or sometimes impossible.
In the SAAS platform WordPress.com, we shall see that CORS is very limited, and authenticated requests require explicit permission by the current user.
The Drupal SAAS platforms Drupal Gardens and Acquia Cloud Site Factory do not provide a way to implement CORS. There have been feature requests for adding CORS capability, so it may become possible.
It's unclear whether CORS is possible in the SAAS versions of Joomla! and Adobe Experience Manager.
The demand for the capability of CORS will likely be satisfied in these SAAS platforms eventually, so we recommend contacting support and asking them explicitly whether CORS can be implemented.