Underconstruction Project Underconstruction vulnerabilities

CVE-2021-39320 [MEDIUM] CWE-79 CVE-2021-39320: The underConstruction plugin <= 1.18 for WordPress echoes out the raw value of `$GLOBALS['PHP_SELF'] The underConstruction plugin <= 1.18 for WordPress echoes out the raw value of `$GLOBALS['PHP_SELF']` in the ucOptions.php file. On certain configurations including Apache+modPHP, this makes it possible to use it to perform a reflected Cross-Site Scripting attack by injecting malicious code in the request path.

CVE-2013-2699 [MEDIUM] CWE-352 CVE-2013-2699: Cross-site request forgery (CSRF) vulnerability in the underConstruction plugin before 1.09 for Word Cross-site request forgery (CSRF) vulnerability in the underConstruction plugin before 1.09 for WordPress allows remote attackers to hijack the authentication of administrators for requests that deactivate a plugin via unspecified vectors.

CVE-2022-1896 [MEDIUM] CWE-79 CVE-2022-1896: The underConstruction WordPress plugin before 1.21 does not sanitise or escape the "Display a custom The underConstruction WordPress plugin before 1.21 does not sanitise or escape the "Display a custom page using your own HTML" setting before outputting it, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiletred_html capability is disallowed.

CVE-2022-1895 [MEDIUM] CWE-352 CVE-2022-1895: The underConstruction WordPress plugin before 1.20 does not have CSRF check in place when deactivati The underConstruction WordPress plugin before 1.20 does not have CSRF check in place when deactivating the construction mode, which could allow attackers to make a logged in admin perform such action via a CSRF attack