Smart Maintenance Mode < 1.5.2 – Admin+ Stored XSS | CVE 2024-12683 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Proof of Concept

1. W/o any Custom HTML content in the settings, set the "heading" and/or "sub-heading" field with the following payload `<script>alert(1)</script>` and save.
2. When you view the site on the frontend you will see the XSS.

Affects Plugins

smart-maintenance-mode

Fixed in 1.5.2

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Dogus DEMIRKIRAN

Submitter

Dogus DEMIRKIRAN

Verified

Yes

WPVDB ID

1569ee00-56c3-4a1b-940e-e0256a748675

Timeline

Publicly Published

2025-03-05 (about 10 months ago)

Added

2025-03-05 (about 9 months ago)

Last Updated

2025-03-05 (about 9 months ago)

Other

Published

Title

Published

2024-07-08

Title

Unlimited Elements For Elementor (Free Widgets, Addons, Templates) < 1.5.113 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'email'

Published

2025-07-24

Title

ElementsKit Elementor Addons and Templates < 3.5.3 - Contributor+ Stored XSS

Published

2025-01-14

Title

Eazy Under Construction < 2.0 - Reflected Cross-Site Scripting

Published

2024-11-27

Title

EmbedPress – Embed PDF, 3D Flipbook, Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Audios, Google Maps in Gutenberg Block & Elementor < 4.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'provider_name'

Published

2015-01-31

Title

Geo Mashup <= 1.8.2 - Cross-Site Scripting (XSS)