WordPress underconstruction has 4 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2021-39320 | The underConstruction plugin <= 1.18 for WordPress echoes out the raw value of `$GLOBALS['PHP_SELF']` in the ucOptions.php file. On certain | medium | 6.1 | <1.19 | 1.19 |
| CVE-2013-2699 | Cross-site request forgery (CSRF) vulnerability in the underConstruction plugin before 1.09 for WordPress allows remote attackers to hijack | medium | 6.8 | <=1.08 or =1.0 or =1.01 or =1.02 or =1.03 or =1.04 or =1.05 or =1.06 or =1.07 | – |
| CVE-2022-1896 | The underConstruction WordPress plugin before 1.21 does not sanitise or escape the "Display a custom page using your own HTML" setting befor | medium | 4.8 | <1.21 | 1.21 |
| CVE-2022-1895 | The underConstruction WordPress plugin before 1.20 does not have CSRF check in place when deactivating the construction mode, which could al | medium | 4.3 | <1.20 | 1.20 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# PHP projects (recommended) composer require --dev phpwarden/phpwarden # then vendor/bin/phpwarden wordpress /var/www/html # or, without Composer pipx install phpwarden && phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked