Description (CNA)
The underConstruction plugin <= 1.18 for WordPress echoes out the raw value of `$GLOBALS['PHP_SELF']` in the ucOptions.php file. On certain configurations including Apache+modPHP, this makes it possible to use it to perform a reflected Cross-Site Scripting attack by injecting malicious code in the request path.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Noah Kagan / underConstruction | affected 1.18 through 1.18 |
CWE
CWE-79
References
- https://wpscan.com/vulnerability/49ae1df0-d6d2-4cbb-9a9d-bf3599429875
- https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39320
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.