CVE-2021-39320

MEDIUMNuclei

underConstruction <= 1.18 - Reflected Cross-Site Scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2021-39320 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The underConstruction plugin <= 1.18 for WordPress echoes out the raw value of `$GLOBALS['PHP_SELF']` in the ucOptions.php file. On certain configurations including Apache+modPHP, this makes it possible to use it to perform a reflected Cross-Site Scripting attack by injecting malicious code in the request path.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated May 5, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

underConstruction

Browse Noah Kagan / underConstruction
CVE List1.18 to ≤ 1.18affected

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Under Construction <1.19 - Cross-Site ScriptingCVSS 6.1

WordPress Under Construction plugin before 1.19 contains a cross-site scripting vulnerability. The plugin echoes out the raw value of `$GLOBALS['PHP_SELF']` in the ucOptions.php file on certain configurations, including Apache+modPHP.

Impact

The vulnerability allows an attacker to inject malicious scripts into the website, potentially leading to unauthorized access, data theft, or defacement.

Remediation

Update to the latest version of the WordPress Under Construction plugin (1.19 or higher) to fix the XSS vulnerability.

WeaknessesCWE-79
AuthorsdhiyaneshDK
Template tagscve2021cvewp-pluginwpscanwordpresswpxssauthenticatedunderconstruction_projectvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:underconstruction_project:underconstruction:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/49ae1df0-d6d2-4cbb-9a9d-bf3599429875 https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39320 https://nvd.nist.gov/vuln/detail/CVE-2021-39320 https://github.com/ARPSyndicate/kenzer-templates https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

3