The Mojo Under Construction plugin version 1.1.2 or earlier contains an improper neutralization of input during web page generation that allows attackers to inject malicious script through reflected XSS. A malicious user can craft a URL or form input that, when echoed by the plugin, executes arbitrary JavaScript in the victim’s browser, enabling credential theft, site defacement, or data exfiltration.

The vulnerability affects all installations of the Mojo Under Construction plugin distributed by mojowill up to and including version 1.1.2. No additional version constraints are listed.

The CVSS score of 7.1 indicates a high potential impact if exploit is successful. The EPSS score of less than 1 % shows exploitation is currently rare, yet not impossible, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw is a reflected XSS, the attack vector is likely network‑based and requires the victim to visit a crafted URL or submit a malicious request, after which the injected script runs in the victim’s browser context.