CVE-2025-15665
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The Ultimate Before After Image Slider & Gallery WordPress plugin before version 4.7.1 does not escape the value of the BEAF Slider widget's shortcode field before outputting it on the front end. The value is passed through do_shortcode, which echoes non-shortcode content verbatim, allowing users with administrator-level access to store a script that executes in the browser of any visitor who loads a page displaying the widget.
Risk Assessment
An attacker with administrator privileges can inject a malicious JavaScript script that executes in the browsers of all visitors, leading to session theft, redirects, or other XSS attacks.
Recommendation
Immediately update the Ultimate Before After Image Slider & Gallery plugin to version 4.7.1 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Ultimate Before After Image Slider & Gallery
See all- CVE-2025-15664Medium
The Ultimate Before After Image Slider & Gallery WordPress plugin before version 4.7.19 does not properly escape the slider's before-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser of anyone (including an administrator) who views the slider.
- CVE-2025-15663Medium
The Ultimate Before After Image Slider & Gallery WordPress plugin before version 4.7.19 does not properly escape the slider's after-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser of anyone (including an administrator) who views the slider.
Original NVD description (English source)
The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.1 does not escape the value of the BEAF Slider widget's shortcode field before outputting it on the front end (the value is passed through do_shortcode, which echoes non-shortcode content verbatim), allowing users with administrator-level access to store a script that executes in the browser of any visitor who loads a page displaying the widget.