CVE-2025-9030: WordPress Majestic Before After Image XSS

CVE-2025-9030 Overview

CVE-2025-9030 is a stored cross-site scripting (XSS) vulnerability in the Majestic Before After Image plugin for WordPress. The flaw affects all versions up to and including 2.0.1. It stems from insufficient input sanitization and output escaping on the before_label and after_label parameters. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any user who visits an affected page [CWE-79].

Critical Impact
Authenticated contributors can inject persistent JavaScript that executes against site visitors and administrators, enabling session theft, redirection, and administrative actions on behalf of privileged users.

Affected Products

Majestic Before After Image plugin for WordPress
Versions <= 2.0.1
WordPress sites permitting contributor-level or higher registration

Discovery Timeline

2025-10-04 - CVE-2025-9030 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-9030

Vulnerability Analysis

The vulnerability is a stored XSS issue in the Majestic Before After Image plugin's shortcode label parameters. The plugin accepts user-supplied values for the before_label and after_label attributes without applying adequate sanitization on input or escaping on output. When a contributor embeds the shortcode in a post or page, arbitrary HTML and JavaScript can be persisted into the rendered output. Any visitor who loads the affected page triggers the payload in their browser session.

Root Cause

The plugin fails to enforce a strict sanitization routine such as sanitize_text_field() on the incoming label attributes. It also omits contextual escaping functions like esc_attr() or esc_html() when emitting the values into the HTML response. This combination allows script content to survive both storage and rendering, satisfying the classic stored XSS pattern described in [CWE-79].

Attack Vector

Exploitation requires an authenticated account with contributor privileges or higher. The attacker inserts a malicious payload into either the before_label or after_label shortcode attribute within post content. Once the post is saved and viewed, the browser parses the injected markup and executes attacker-controlled JavaScript in the context of the site's origin. Refer to the Wordfence Vulnerability Report for further technical details.

Detection Methods for CVE-2025-9030

Indicators of Compromise

Post or page content containing the plugin's shortcode with <script>, onerror, onload, or javascript: payloads in the before_label or after_label attributes.
Unexpected outbound requests from visitor browsers to attacker-controlled domains after loading pages built with the plugin.
New or modified administrator accounts, plugin installations, or option changes following contributor activity.

Detection Strategies

Query the wp_posts table for the plugin shortcode combined with suspicious HTML entities or event handlers in the label parameters.
Review WordPress audit logs for contributor accounts that publish or preview pages using the affected shortcode.
Inspect rendered HTML for unescaped <, >, and quote characters within elements produced by the plugin.

Monitoring Recommendations

Alert on creation of pages containing the plugin shortcode by non-administrator roles.
Monitor Content Security Policy (CSP) violation reports for inline script executions on pages using the plugin.
Track plugin version inventory across managed WordPress sites and flag installations running 2.0.1 or earlier.

How to Mitigate CVE-2025-9030

Immediate Actions Required

Update the Majestic Before After Image plugin to the version published in WordPress Changeset 3358300.
Audit contributor and author accounts, remove unused accounts, and reset credentials for suspicious users.
Review recent posts and pages for injected payloads in the before_label and after_label parameters and remove malicious content.

Patch Information

The plugin maintainer addressed the issue in the update tracked by WordPress Changeset 3358300, which introduces sanitization and escaping on the affected label parameters. Site owners should upgrade to the fixed release immediately. Additional context is available in the Wordfence Vulnerability Report.

Workarounds

Deactivate the Majestic Before After Image plugin until it can be upgraded to a patched version.
Restrict contributor role assignments and require administrator review before content publication.
Deploy a web application firewall (WAF) rule to block HTML and JavaScript payloads submitted to the plugin's shortcode attributes.

bash

# Configuration example
wp plugin update majestic-before-after-image
wp plugin status majestic-before-after-image