Description

Unauthenticated Cross Site Scripting (XSS) in Under Construction <= 5.82 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-03T17:17:24.290Z",
  "pubdate": "2026-09-03T17:17:24.290Z",
  "executiveSummary": "The 'Under Construction' plugin for WordPress, in all versions up to and including 5.82, contains a critical security vulnerability involving unauthenticated Cross-Site Scripting (XSS).\nThis vulnerability allows an unauthenticated, remote attacker to inject malicious JavaScript code into the web application, which is then executed within the browser context of any user visiting the site, including administrative personnel.\nThe risk implication is significant as the flaw permits unauthorized script execution without requiring any prior authentication, privilege level, or internal access to the system.\nSuccessful exploitation can lead to a complete compromise of the user's session, enabling the theft of session tokens (cookies), sensitive data exfiltration, unauthorized administrative actions, or the redirection of users to malicious third-party domains.\nThe vulnerability resides in the way the plugin handles user-supplied input before reflecting it back to the end-user's browser, lacking proper sanitization or encoding mechanisms.\nGiven the nature of XSS, the attack is executed through the victim's web browser, rendering server-side firewalls potentially ineffective if they are not specifically configured to inspect and sanitize HTTP request parameters for malicious scripts.",
  "technicalDetails": "The vulnerability is identified as a Stored or Reflected Cross-Site Scripting (XSS) flaw, stemming from the insufficient sanitization of input parameters within the 'Under Construction' plugin versions 5.82 and earlier.\nThe root cause of this vulnerability lies in the improper handling of user-controllable input fields. The application accepts input via HTTP requests and fails to perform context-aware output encoding or strict input validation before reflecting that data back in the HTML response provided to the user's browser.\nThe attack flow begins when an unauthenticated attacker crafts a malicious HTTP request containing a carefully constructed JavaScript payload. This request targets the vulnerable parameter handled by the plugin. When the server processes this request and subsequently includes the tainted data in the generated HTML page, the malicious script is injected directly into the Document Object Model (DOM) of the page.\nWhen a victim visits the compromised page, the victim's browser interprets the injected payload as legitimate application code and executes it within the security context of the victim's session. Because the execution occurs in the context of the vulnerable site, the script has access to session-specific information, such as document.cookie, which may contain sensitive authentication session identifiers.\nThe exploitation does not require the attacker to have administrative privileges or existing user accounts. The attack vector is exposed to the public network, allowing any remote actor to trigger the payload simply by directing a user to a URL crafted with the malicious input.\nUpon successful execution, the attacker can leverage the XSS payload to perform a variety of post-exploitation activities. This includes, but is not limited to, hijacking administrative accounts through session theft, performing unauthorized actions on behalf of the user, altering the visual content of the website (defacement), or using the victim's browser as a pivot point for further attacks on the internal network.\nThe vulnerability persists across all versions up to 5.82, as the lack of robust input sanitization routines remains consistent throughout this version range. The absence of effective Content Security Policy (CSP) headers or similar browser-side security controls further exacerbates the impact of this flaw, allowing for the unrestricted execution of unauthorized scripts."
}