CVE-2025-1490 is a reflected cross-site scripting vulnerability in the Smart Maintenance Mode plugin for WordPress developed by brijeshk89. The issue occurs due to improper neutralization of user input in the 'setstatus' parameter, which is not adequately sanitized or escaped before being included in web pages. This allows attackers to craft malicious URLs that, when visited by users, execute arbitrary JavaScript in the context of the affected site. The vulnerability affects all versions up to and including 1.5.2. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity.

Successful exploitation can lead to the execution of arbitrary scripts in the context of the affected website, potentially allowing attackers to steal user credentials, perform actions on behalf of users, or conduct phishing attacks. The impact is limited to confidentiality and integrity with no availability impact. The vulnerability requires user interaction and does not require authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the plugin or restricting access to the affected functionality. Additionally, users should be cautious about clicking on suspicious links that may exploit this vulnerability.