CVE-2022-1896: 
WordPress vulnerability analysis and mitigation

CVE-2022-1896 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the WordPress underConstruction plugin versions below 1.21. The vulnerability was discovered and publicly disclosed on May 26, 2022. The issue affects the plugin's custom HTML page display functionality (WPScan).

The vulnerability exists because the plugin does not properly sanitize or escape the "Display a custom page using your own HTML" setting before outputting it. This allows high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. The vulnerability has been assigned a CVSS score of 3.4 (Low) and is classified under CWE-79 (WPScan).

When exploited, this vulnerability allows attackers with high privileges to inject malicious scripts that will be triggered when non-admin users view the homepage. This could potentially lead to session hijacking, credential theft, or other client-side attacks (WPScan).

The vulnerability can be exploited by accessing the plugin's settings, activating the Under Construction feature, selecting "Display a custom page using your own HTML" option, and then inserting malicious payload in the "Under Construction Page HTML" field (WPScan).

The vulnerability has been fixed in version 1.21 of the underConstruction plugin. Users are advised to update to this version or later to mitigate the risk (WPScan).