CVE-2024-12683: 
WordPress vulnerability analysis and mitigation

The Smart Maintenance Mode WordPress plugin before version 1.5.2 contains a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2024-12683. The vulnerability was publicly disclosed on March 5, 2025, and affects the plugin's settings functionality (WPScan, NVD).

The vulnerability stems from improper sanitization and escaping of certain settings within the plugin. It has been assigned a CVSS v3.1 base score of 3.5 (LOW) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N. The issue specifically affects the 'heading' and 'sub-heading' fields in the plugin's settings (WPScan).

This vulnerability allows high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, even in environments where the unfiltered_html capability is disallowed, such as in multisite setups. The impact is considered low due to the high privileges required to exploit the vulnerability (NVD).

The vulnerability has been fixed in version 1.5.2 of the Smart Maintenance Mode WordPress plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).