Under Construction CVE-2026-81295

The Under Construction plugin must be installed and active on the WordPress site, with the vulnerable front-end page publicly accessible (the typical deployment mode, since the plugin is designed to display pages to unauthenticated visitors). No authentication is required from the attacker (PR:N). A victim user must be induced to click or follow a crafted URL (UI:R), which limits fully automated mass exploitation. Limiting factors: victim interaction is mandatory, meaning purely passive exploitation against idle users is not possible; exploitation against administrators for session hijacking requires the administrator to be logged in and click the link; sites with strict Content Security Policy (CSP) headers may further limit script execution even if the injection point is reachable.

The CVSS 7.1 score reflects a network-reachable, low-complexity, zero-privilege XSS requiring only victim interaction (AV:N/AC:L/PR:N/UI:R/S:C). EPSS data was not provided, and the CVE is not listed in CISA KEV, suggesting opportunistic but not confirmed active exploitation. The A:L component of the vendor CVSS is mildly overstated for a pure XSS - availability impact is not a typical outcome of reflected XSS and is more defensible only if the payload can crash or hang the page. Real-world risk is moderate: sites using this plugin to display maintenance pages may expose the vulnerable endpoint to the entire public internet, making the attack surface broad even if per-victim exploitation requires social engineering. The absence of authentication requirements is the primary risk amplifier; if administrators are targeted, account takeover via cookie theft becomes a plausible high-impact scenario. No POC or KEV listing reduces urgency compared to a raw CVSS reading.

An attacker identifies a WordPress site running the Under Construction plugin and discovers a URL parameter that is reflected unsanitized in the plugin's maintenance page. The attacker crafts a malicious URL embedding a JavaScript payload and distributes it via phishing email to the site's administrator; when the administrator clicks the link, the script executes in their browser session, exfiltrating their WordPress authentication cookie and granting the attacker administrative access to the site. No public exploit code has been identified, but the low-complexity, zero-privilege nature of the flaw makes manual exploitation straightforward for any attacker familiar with XSS techniques.