Vulnerability · Published Sep 1, 2021 · Assigned by Wordfence

CVE-2021-39320underConstruction <= 1.18 - Reflected Cross-Site Scripting

Medium 6.1

In plain English

A medium-severity cross-site scripting in underConstruction from Noah Kagan. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 84% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)2.3%top 16.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Nuclei

Official description

The underConstruction plugin <= 1.18 for WordPress echoes out the raw value of `$GLOBALS['PHP_SELF']` in the ucOptions.php file. On certain configurations including Apache+modPHP, this makes it possible to use it to perform a reflected Cross-Site Scripting attack by injecting malicious code in the request path.

Affected products (as reported)

Vendor	Product	Versions
Noah Kagan	underConstruction	1.18 – through 1.18

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

https://wpscan.com/vulnerability/49ae1df0-d6d2-4cbb-9a9d-bf3599429875 x_refsource_MISC
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39320 x_refsource_MISC