Skip to content
Sign in
Not rated

CVE-2022-1896 The underConstruction WordPress plugin before 1.21 does not sanitise or escape the "Display a custom page using your own…

Description

The underConstruction WordPress plugin before 1.21 does not sanitise or escape the "Display a custom page using your own HTML" setting before outputting it, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiletred_html capability is disallowed.

Affected products and versions

Product Affected versions Fixed in
underConstruction 1.21 earliest → < 1.21 1.21

Other CVEs of underConstruction

The 2 CVEs of underConstruction →
CVE-2022-1895 The underConstruction WordPress plugin before 1.20 does not have CSRF check in place when deactivating the… Not rated
Track this CVE