Under Construction

Under Construction has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2026; all 5 are fixed as of September 2026. Their average CVSS score is 5.6, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high. 2026 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 2 of the records (40%). Other recurring categories include Cross-Site Scripting, Path Traversal.

Every one of the 5 issues recorded for Under Construction has a vendor fix available, so running the current release closes all known holes.

4 independent researchers contributed these findings, most of them (2) reported by Ram. Under Construction is installed on roughly 600,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSMedium
5.6/ 10
Patch Coverage100%
Open

0

Fixed

5

Get automatic notifications for all Under Construction vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.2CVE-2026-81295

Under Construction <= 5.82 - Unauthenticated Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

5 records
Under Construction banner
Latestv5.83

Under Construction

WebFactory

Author

WebFactory

4.8(1,285)
96/100
Last Updated
2026-09-09 (3d ago)
Active Installs
600,000+
Downloads
13,671,857
Requires WP
4.0+
Requires PHP
5.2+
Tested up to
WP 7.0.4
Created
2013-12-01 (13y ago)

Create an Under Construction Page, Maintenance Mode Page, Coming Soon Page or a Landing Page that takes less than a minute to install & configure. Under Construction won’t waste your time! It’s simple, fast, efficient & user-friendly with 500+ great templates users love. Under Construction uses Bunny Fonts for GDPR compatibility. PRO version offers more than 50 extra features and options including the drag&drop builder, over a million hi-res searchable images, 500+ templates, affiliate&traffic tracking, advanced access control, MailChimp, Zapier & universal autoresponder integration, white-label license mode and priority support. Find out more on the official plugin site. A simple, no-nonsense under construction plugin for all those situations when you have to hide the site behind an Under Construction page for a while. Live examples are available on the Under Construction website. Give us a shout on X @WebFactoryLtd or check out the video. Thanks to our partnership with Weglot, UCP is fully multilanguage ready and you can instantly translate your under construction page to 100+ languages with one click. Having problems with spam, bots, or AI scrapers? Have a look at our free Captcha plugin used on over 200,000 sites. Options Under construction mode – on / off Automatic End date & time – automatically disable under construction mode on a set date Google Analytics Tracking ID – enable tracking via Google Analytics Theme – test all available themes (500+) Custom CSS – adjust any part of the page to fit your needs Title – page title, for SEO Description – page description, for SEO Headline – main headline/title Content – anything you need to display Optin box, optin popup – collect leads and emails and sync with MailChimp and other autoresponders Login Button – show a discrete link to the login form, or WP admin if you’re logged in Social icons/links – new ones are added with every update; let us know if we missed your favorite ones Facebook X (Twitter) LinkedIn YouTube Vimeo Pinterest Dribbble Behance Instagram Email Phone Skype Telegram WhatsApp Tumblr VK Whitelisted User Roles – user roles who see the site, instead of under construction page Whitelisted Users – users who see the site, instead of under construction page If you’re having problems with SSL or HTTPS try our free WP Force SSL plugin. It’s a great plugin to enable SSL and fix SSL issues. Under Construction Page is compatible with the following caching plugins: W3 Total Cache, WP Super Cache, Endurance Page Cache, SiteGround SuperCacher, WP Fastest Cache, Swift Performance Cache, WP Rocket, Cache Enabler, and Hummingbird cache. What are others saying about the Under Construction Page plugin WHSR wrote an in-depth guide on how to “Grow Your Blog Before It Is Born” featuring Under Construction Page John Fraskos from Codestag says it’s “very friendly and easy to use” WP Pluginsify wrote a review Erik from NoPassiveIncome points out: “plugin is so easy and quick to use” Planet WP gave it 5/5 stars FirstSiteGuide says: “a perfect choice” WPblog wrote a review as well WP TopDog had Daniel explain how to use the Under Construction Page GDPR Compatibility We are not lawyers. Please do not take any of the following as legal advice. Under Construction plugin uses Bunny Fonts on the front end, and in the admin. Usage of the Google Analytics service is optional. No other resources are loaded from or shared with 3rd parties. Opting to use Bunny Fonts and/or Google Analytics will result in data sharing/tracking as described in their terms of service. If you opt to activate your PRO license in the plugin admin, some data will be shared with WebFactory Ltd; that’s clearly noted below the license activation form.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C