Vulnerabilities and security researches forsmart-maintenance-mode smart-maintenance-mode

Jun 07, 2024

CVE, Research URL: CVE-2024-33638
Home page URL: Security reports for Smart Maintenance Mode
Application: Smart Maintenance Mode
Date: Apr 26, 2024
Research Description: Cross-Site Request Forgery (CSRF) vulnerability in Brijesh Kothari Smart Maintenance Mode.This issue affects Smart Maintenance Mode: from n/a through 1.4.4.
Affected versions: Min -, max -.
Status: vulnerable

Mar 27, 2025

CVE, Research URL: CVE-2024-12682
Home page URL: Security reports for Smart Maintenance Mode
Application: Smart Maintenance Mode
Date: Mar 25, 2025
Research Description: The Smart Maintenance Mode WordPress plugin before 1.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Affected versions: Min -, max -.
Status: vulnerable

CVE, Research URL: CVE-2025-1490
Home page URL: Security reports for Smart Maintenance Mode
Application: Smart Maintenance Mode
Date: Mar 26, 2025
Research Description: The Smart Maintenance Mode plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘setstatus’ parameter in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected versions: Min -, max -.
Status: vulnerable

May 06, 2025

CVE, Research URL: CVE-2024-12683
Home page URL: Security reports for Smart Maintenance Mode
Application: Smart Maintenance Mode
Date: Mar 26, 2025
Research Description: The Smart Maintenance Mode WordPress plugin before 1.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Affected versions: Min -, max -.
Status: vulnerable