CVE-2021-39320: underConstruction <= 1.18 - Reflected Cross-Site Scripting

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-09-01 · updated 2026-06-17
Weakness: CWE-79

Description

The underConstruction plugin <= 1.18 for WordPress echoes out the raw value of `$GLOBALS['PHP_SELF']` in the ucOptions.php file. On certain configurations including Apache+modPHP, this makes it possible to use it to perform a reflected Cross-Site Scripting attack by injecting malicious code in the request path.

Affected products

underConstruction: before 1.19 — fixed in 1.19

How to fix

Upgrade to a fixed version: underConstruction 1.19. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/49ae1df0-d6d2-4cbb-9a9d-bf3599429875
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39320
https://wpscan.com/vulnerability/49ae1df0-d6d2-4cbb-9a9d-bf3599429875
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39320

Get alerted when CVE-2021-39320 or the next vulnerability affects your stack