CVE-2026-62028

MediumCVSS 5.4

Published: 09/10/2026(UTC)Updated: 11/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

3th percentile - higher than 3% of all known CVEs

Summary

The Before After Image Comparison – Image comparison for WP plugin up to version 1.1.21 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

Risk Assessment

Unauthorized users may gain access to functions they should not have permissions for, potentially leading to confidentiality or integrity breaches.

Recommendation

It is recommended to update the plugin to a version newer than 1.1.21 that includes a fix for the authorization issue.

Other vulnerabilities in Before After Image Comparison – Image comparison for WP

CVE-2026-62034High
Unauthenticated Cross Site Scripting (XSS) in the Before After Image Comparison – Image comparison for WP plugin up to version 1.1.21. An attacker can inject malicious script into the page.

Original NVD description (English source)

Missing Authorization vulnerability in bPlugins Before After Image Comparison – Image comparison for WP before-after-image-compare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Before After Image Comparison – Image comparison for WP: from n/a through 1.1.21.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS