The Smart Maintenance Mode plugin contains a reflected cross‑site scripting flaw in the setstatus input parameter. Insufficient sanitization and escaping allow an unauthenticated user to embed arbitrary JavaScript which is then executed in the victim’s browser when the parameter value is reflected back. This flaw can be used to execute scripts with the victim’s privileges, potentially stealing session cookies, hijacking sessions, or defacing the site.

WordPress sites that use the Smart Maintenance Mode plugin developed by brijeshk89 are affected. Versions up to and including 1.5.2 contain the vulnerability. All users running these or earlier releases should be aware that the plugin does not properly sanitize the setstatus parameter.

The CVSS score of 6.1 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit this flaw without authentication by directing a victim to a crafted URL that includes malicious code in the setstatus parameter; when the victim clicks the link, the script executes in the site’s context.