Really Simple Under Construction Page – Coming Soon & Maintenance Mode
Really Simple Under Construction Page – Coming Soon & Maintenance Mode has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 5.5, and the most serious one scores 5.5 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Really Simple Under Construction Page – Coming Soon & Maintenance Mode has a vendor fix available, so running the current release closes it.
All of these findings were reported by Nabil Irawan. Really Simple Under Construction Page – Coming Soon & Maintenance Mode is installed on roughly 800 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2025-47593Really Simple Under Construction Page <= 1.4.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records
Really Simple Under Construction Page – Coming Soon & Maintenance Mode
Author
Jonas Hjalmarsson
Tick one checkbox and your site is hidden behind an Under Construction page. Visitors see your holding page; you and anyone you let through see the real site. That is the whole plugin. Two ways to get past the page without logging in: A secret word. Visit yoursite.com/?yoursecret once and a cookie keeps that browser through. Good for showing a client work in progress. An IP whitelist. Your office, your phone, an uptime monitor — they always see the live site. Logged-in users are never blocked, and /wp-admin, the REST API, WP-CLI and cron keep working normally. The page itself is your HTML. Paste in a full document with DOCTYPE, <style> and <body> if you want, or a single line of text. No page builder, no template picker, no upsell wizard — no settings you have to learn before the plugin does its job. Use it for Coming soon pages for a site that has not launched yet. Maintenance mode while you rebuild, migrate or debug. Staging and client-preview sites you want off the public web and out of Google. Settings Go to the settings page in Settings > Really Simple Under Construction. Enable by checking the checkbox. The Under Construction page is only visible to visitors who are not logged in. You can optionally configure: The Under Construction page itself — paste any HTML (DOCTYPE, <style>, <body> etc. are supported, scripts are stripped). A secret word that lets you bypass the page via a URL like ?yoursecret. A cookie is then stored so the same browser keeps access. The lifetime of that cookie, in days. A list of IP addresses to whitelist for users and services that should always see the real site.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C