https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2022-1896.htmlhttps://patchthecve.com/cve/CVE-2022-1896.htmlWed, 17 Jun 2026 04:23:18 +0000MEDIUM 4.8: The underConstruction WordPress plugin before 1.21 does not sanitise or escape the "Display a custom page using your own HTML" setting before outputting it, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiletred_html capability is disallowed.https://patchthecve.com/cve/CVE-2022-1895.htmlhttps://patchthecve.com/cve/CVE-2022-1895.htmlWed, 17 Jun 2026 04:23:18 +0000MEDIUM 4.3: The underConstruction WordPress plugin before 1.20 does not have CSRF check in place when deactivating the construction mode, which could allow attackers to make a logged in admin perform such action via a CSRF attackhttps://patchthecve.com/cve/CVE-2021-39320.htmlhttps://patchthecve.com/cve/CVE-2021-39320.htmlWed, 17 Jun 2026 04:03:32 +0000MEDIUM 6.1: The underConstruction plugin <= 1.18 for WordPress echoes out the raw value of `$GLOBALS['PHP_SELF']` in the ucOptions.php file. On certain configurations including Apache+modPHP, this makes it possible to use it to perform a reflected Cross-Site Scripting attack by injecting malicious code in the r