Under Construction, Coming Soon & Maintenance Mode

Under Construction, Coming Soon & Maintenance Mode has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2026; all 3 are fixed as of October 2026. Their average CVSS score is 5.9, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high. 2021 was the busiest year with 2 disclosures.

The most common weakness is Server-Side Request Forgery (SSRF), behind 2 of the records (67%). Other recurring categories include Cross-Site Request Forgery (CSRF).

Every one of the 3 issues recorded for Under Construction, Coming Soon & Maintenance Mode has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, most of them (2) reported by Mr.F. Under Construction, Coming Soon & Maintenance Mode is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
5.9/ 10
Patch Coverage100%
Open

0

Fixed

3

Get automatic notifications for all Under Construction, Coming Soon & Maintenance Mode vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.2

Under Construction, Coming Soon & Maintenance Mode <= 1.1.1 - Server Side Request Forgery

Read the full analysis

Vulnerability Records

3 records
Under Construction, Coming Soon & Maintenance Mode banner
Latestv3.1.0

Under Construction, Coming Soon & Maintenance Mode

WPBrigade

Author

WPBrigade

4.6(46)
92/100
Last Updated
2026-10-19 (9d ago)
Active Installs
10,000+
Downloads
254,151
Requires WP
5.0+
Requires PHP
7.4+
Tested up to
WP 7.1.3
Created
2017-02-25 (10y ago)

Under Construction, Coming Soon & Maintenance Mode plugin makes you create or set up Maintenance Mode Page, Coming Soon Page, or Under Construction Page for your upcoming new WordPress website. This Under Construction plugin is a simple & easy to use WordPress plugin and works with any WordPress theme and plugin. With this plugin, you can create a maintenance mode landing page without any coding skills. It’s a completely free WordPress plugin. Features Can easily change or upload any background image. You can easily disable the Under Construction for your different roles (Admin, Editor, Author, Subscriber, Customer, Shop Manager, or any other role). You can easily upload the logo and set the Height and width of your Logo Easily update the content of your page that includes Main header text and Subheading text, including text color. You can also add social media icons and links to your landing page. Can add custom CSS to customize the design of your landing page. With UCMM you can easily apply SEO on your page that includes (SEO Title, Description, Keyword, SEO URL, SEO Site Name, and SEO Author name) UCMM plugin also allows you to add the Google Analytics Tracking Code to your landing page for tracking. You can also set your Maintenance mode starting and ending date with the UCMM plugin. You can easily preview your page in the UCMM customizer before activation. Page created with this plugin is fully mobile-friendly (responsive). If you find our plugin useful, please leave a good rating/review and check our other plugins. Analytify – Google Analytics Plugin LoginPress – For Custom login page and login page security Simple Social Buttons – Plugin for Social share buttons and social icons Related Posts Thumbnails Plugin – For related posts/products Under Construction, Coming Soon & Maintenance Mode – Plugin for Under construction & Coming soon page External services This plugin connects to the following external services. WPBrigade telemetry (app.telemetry.wpbrigade.com) After activation, the plugin shows an opt-in screen. If you allow sharing, it sends your site and home URLs, admin email and name, WordPress, PHP and MySQL versions, server details, locale, active theme, the plugin’s settings, the IP address of the request and its country. It sends again when the plugin is activated, deactivated or uninstalled, and once a day while you stay opted in. If you click Skip instead, a single activation event with the same site details is sent and nothing more after that. If you submit the optional deactivation feedback form, your answer is sent too. You can opt out at any time from the Plugins screen. Terms of use: https://wpbrigade.com/terms-and-conditions/ Privacy policy: https://wpbrigade.com/privacy-policy/ iplocation.net Each time telemetry site details are sent (see above), the IP address of the current request is sent to api.iplocation.net to look up its country. Privacy policy: https://www.iplocation.net/privacy-policy Google Fonts The opt-in screen shown after activation loads the Poppins font from fonts.googleapis.com and fonts.gstatic.com, so the viewing administrator’s IP address and browser user agent are sent to Google. The maintenance page and the plugin’s admin pages use the Oswald and Inter fonts bundled with the plugin and make no requests to Google. Terms of use: https://developers.google.com/fonts/terms Privacy policy: https://policies.google.com/privacy

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C