underConstruction

underConstruction has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2014 and 2024; all 5 are fixed as of September 2026. Their average CVSS score is 6.7, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 2 high. 2022 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 3 of the records (60%). Other recurring categories include Cross-Site Request Forgery (CSRF).

Every one of the 5 issues recorded for underConstruction has a vendor fix available, so running the current release closes all known holes.

4 independent researchers contributed these findings, one record each. underConstruction is installed on roughly 40,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.4.10.

Strategic Overview

Avg CVSSMedium

6.7/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all underConstruction vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2022-1895

underConstruction <= 1.19 - Cross-Site Request Forgery to Construction Mode Disabled

Read the full analysis

Vulnerability Records

5 records


2024-03-29 00:00	underConstruction <= 1.21 - Authenticated (Administrator+) Stored Cross-Site Scripting underConstruction <= 1.21	`CVE-2024-30548`	4.4 Medium	Felipe Restrepo Rodriguez (pfelilpe)	Yes
2022-05-26 00:00	underConstruction <= 1.20 - Authenticated (Admin+) Stored Cross-Site Scripting underConstruction < 1.21	`CVE-2022-1896`	5.5 Medium	Asif Nawaz Minhas	Yes
2022-05-26 00:00	underConstruction <= 1.19 - Cross-Site Request Forgery to Construction Mode Disabled underConstruction < 1.20	`CVE-2022-1895`	8.8 High	Daniel Ruf	Yes
2021-08-31 00:00	underConstruction <= 1.18 - Reflected Cross-Site Scripting underConstruction <= 1.18	`CVE-2021-39320`	6.1 Medium	Ram	Yes
2014-08-01 00:00	underConstruction < 1.09 - Cross-Site Request Forgery underConstruction < 1.09	`CVE-2013-2699`	8.8 High	Anonymous	Yes

Showing 1–5 of 5 reports

Latestv1.22

underConstruction

Author

Garrett Grimm

4.5(111)

90/100

Last Updated

2024-03-08 (3y ago)

Active Installs

40,000+

Downloads

1,753,776

Requires WP

2.7+

Requires PHP

Tested up to

WP 6.4.10

Created

2009-06-21 (18y ago)

Check out the latest WordPress deals for your site. Creates a ‘Coming Soon’ page that will show for all users who are not logged in. Useful for developing a site on a live server, without the world being able to see it

View on WordPress.org