CVE-2025-1490

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-1490", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-02-19T22:33:34.783Z", "datePublished": "2025-03-26T02:23:49.553Z", "dateUpdated": "2026-04-08T17:31:01.695Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:31:01.695Z"}, "affected": [{"vendor": "brijeshk89", "product": "Smart Maintenance Mode", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.5.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Smart Maintenance Mode plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u2018setstatus\u2019 parameter in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "title": "Smart Maintenance Mode <= 1.5.2 - Reflected Cross-Site Scripting via setstatus Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ea9ca8ac-e735-4e84-af0f-45d22a8e2124?source=cve"}, {"url": "https://wordpress.org/plugins/smart-maintenance-mode/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3271906%40smart-maintenance-mode&new=3271906%40smart-maintenance-mode&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Krzysztof Zaj\u0105c"}], "timeline": [{"time": "2025-03-25T14:11:16.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-26T18:40:13.705324Z", "id": "CVE-2025-1490", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-26T18:40:28.240Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-1490", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-26T18:40:13.705324Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-26T18:40:24.280Z"}}], "cna": {"title": "Smart Maintenance Mode <= 1.5.2 - Reflected Cross-Site Scripting via setstatus Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Krzysztof Zaj\u0105c"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "brijeshk89", "product": "Smart Maintenance Mode", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.5.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-03-25T14:11:16.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ea9ca8ac-e735-4e84-af0f-45d22a8e2124?source=cve"}, {"url": "https://wordpress.org/plugins/smart-maintenance-mode/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3271906%40smart-maintenance-mode&new=3271906%40smart-maintenance-mode&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Smart Maintenance Mode plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u2018setstatus\u2019 parameter in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:31:01.695Z"}}}, "cveMetadata": {"cveId": "CVE-2025-1490", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:31:01.695Z", "dateReserved": "2025-02-19T22:33:34.783Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-03-26T02:23:49.553Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Smart Maintenance Mode", "vendor": "brijeshk89", "versions": [{"lessThanOrEqual": "1.5.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Smart Maintenance Mode plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u2018setstatus\u2019 parameter in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}, {"lang": "es", "value": "El complemento Smart Maintenance Mode para WordPress es vulnerable a Cross-Site Scripting reflejado a trav\u00e9s del par\u00e1metro 'setstatus' en todas las versiones hasta la 1.5.2 incluida, debido a una depuraci\u00f3n de entrada y al escape de salida insuficiente. Esto permite a atacantes no autenticados inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutan si logran enga\u00f1ar al usuario para que realice una acci\u00f3n, como hacer clic en un enlace."}], "id": "CVE-2025-1490", "lastModified": "2026-06-17T08:39:14.870", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-1490", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-03-26T18:40:13.705324Z", "version": "2.0.3"}}]}, "published": "2025-03-26T03:15:12.257", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3271906%40smart-maintenance-mode&new=3271906%40smart-maintenance-mode&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/smart-maintenance-mode/#developers"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ea9ca8ac-e735-4e84-af0f-45d22a8e2124?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T23:28:59.321860+00:00", "value": {"mitigation_remediation": ["Upgrade Smart Maintenance Mode to the latest version that correctly sanitizes the setstatus parameter or remove the plugin if an update is not immediately available.", "If an upgrade is not possible right now, disable the plugin or block its endpoints until a fix is applied.", "Deploy a web application firewall or use a WordPress security plugin to filter or block script content in the setstatus parameter to mitigate the XSS risk.", "Keep the WordPress core and all other plugins updated to reduce the overall attack surface."], "summary": {"action": "Patch Update", "impact": "Unauthenticated reflected cross\u2011site scripting via parameter injection"}, "threat_synthesis": {"affected_systems": "WordPress sites that use the Smart Maintenance Mode plugin developed by brijeshk89 are affected. Versions up to and including 1.5.2 contain the vulnerability. All users running these or earlier releases should be aware that the plugin does not properly sanitize the setstatus parameter.", "description_and_impact": "The Smart Maintenance Mode plugin contains a reflected cross\u2011site scripting flaw in the setstatus input parameter. Insufficient sanitization and escaping allow an unauthenticated user to embed arbitrary JavaScript which is then executed in the victim\u2019s browser when the parameter value is reflected back. This flaw can be used to execute scripts with the victim\u2019s privileges, potentially stealing session cookies, hijacking sessions, or defacing the site.", "risk_and_exploitability": "The CVSS score of 6.1 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit this flaw without authentication by directing a victim to a crafted URL that includes malicious code in the setstatus parameter; when the victim clicks the link, the script executes in the site\u2019s context."}}}}, "created": "2025-06-23T09:16:30.012313+00:00", "updated": "2026-04-20T23:30:16.127310+00:00", "vendors": ["brijeshk89", "brijeshk89$PRODUCT$smart_maintenance_mode", "wordpress", "wordpress$PRODUCT$wordpress"]}