The Majestic Before After Image plugin fails to properly sanitize or escape the content entered in its before_label and after_label fields. Consequently, any text submitted by an authenticated user with contributor or higher privileges is stored unchanged in the database and rendered as part of the page markup when the page is viewed. An attacker can therefore inject arbitrary JavaScript that executes in the victim’s browser, enabling session hijacking, phishing, or other client‑side attacks.

WordPress sites that have the Majestic Before After Image plugin installed with a version of 2.0.1 or earlier. The vulnerability affects all releases up to that version regardless of the WordPress core version.

The CVSS base score of 5.4 indicates a moderate severity. The EPSS score of less than 1% suggests a very low probability of current exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to be logged in with contributor or higher privileges and to submit malicious content via the plugin’s label fields; once stored, the payload will run whenever any user visits the affected page.