CVE-2021-39320
MEDIUM NUCLEIUnderconstruction < 1.19 - XSS
Title source: ruleDescription
The underConstruction plugin <= 1.18 for WordPress echoes out the raw value of `$GLOBALS['PHP_SELF']` in the ucOptions.php file. On certain configurations including Apache+modPHP, this makes it possible to use it to perform a reflected Cross-Site Scripting attack by injecting malicious code in the request path.
Nuclei Templates (1)
WordPress Under Construction <1.19 - Cross-Site Scripting
MEDIUMVERIFIEDby dhiyaneshDK
Scores
CVSS v3
6.1
EPSS
0.1966
EPSS Percentile
95.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-79
Status
published
Products (1)
underconstruction_project/underconstruction
< 1.19
Published
Sep 01, 2021
Tracked Since
Feb 18, 2026