CVE-2026-81295

CVE-2026-81295 is an unauthenticated cross-site scripting vulnerability (CWE-79) in the 'Under Construction' WordPress plugin, which is used to display maintenance or coming-soon pages, affecting all versions through 5.82. The plugin does not adequately sanitize or escape unauthenticated input, so an attacker can craft a request or link containing malicious JavaScript that executes in another user's browser when the crafted URL or affected page is loaded; the exact injection vector (reflected vs. stored) is not specified in the source data. Because no privileges are required (CVSS AV:N/PR:N with user interaction required), an attacker can target a logged-in administrator and gain the ability to run arbitrary JavaScript in the site's context, potentially hijacking an admin session, creating rogue administrator accounts, redirecting visitors, or altering displayed content, with low confidentiality/integrity/availability impact per the score. Any WordPress site running the plugin at version 5.82 or earlier is affected, while sites already updated past 5.82 are not. No public proof-of-concept or in-the-wild exploitation is known at this time: the flaw is not in CISA's KEV, no PoC is documented, and EPSS estimates only a ~0.2% probability of exploitation within 30 days.

What to do: Update the Under Construction plugin to a release newer than 5.82 as soon as one is available (the specific fixed version was not stated in the source data), or deactivate the plugin on any site that cannot be patched. Site owners should also check for unexpected administrator accounts and unexplained content or settings changes, since unauthenticated XSS in WordPress plugins is commonly chained into admin-level compromise.