CVE-2025-15663
MediumCVSS 6.8Summary
The Ultimate Before After Image Slider & Gallery WordPress plugin before version 4.7.19 does not properly escape the slider's after-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser of anyone (including an administrator) who views the slider.
Risk Assessment
The risk is the execution of malicious script in the administrator's browser, potentially leading to session hijacking or other attacks.
Recommendation
Update the Ultimate Before After Image Slider & Gallery plugin to version 4.7.19 or later, which includes the fix.
Other vulnerabilities in Ultimate Before After Image Slider & Gallery
See all- CVE-2025-15664Medium
The Ultimate Before After Image Slider & Gallery WordPress plugin before version 4.7.19 does not properly escape the slider's before-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser of anyone (including an administrator) who views the slider.
- CVE-2025-15665Medium
The Ultimate Before After Image Slider & Gallery WordPress plugin before version 4.7.1 does not escape the value of the BEAF Slider widget's shortcode field before outputting it on the front end. The value is passed through do_shortcode, which echoes non-shortcode content verbatim, allowing users with administrator-level access to store a script that executes in the browser of any visitor who loads a page displaying the widget.
Original NVD description (English source)
The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's after-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser of anyone (including an administrator) who views the slider.