Ultimate Before After Image Slider & Gallery vulnerabilities

The Ultimate Before After Image Slider & Gallery WordPress plugin before version 4.7.19 does not properly escape the slider's before-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser of anyone (including an administrator) who views the slider.

The Ultimate Before After Image Slider & Gallery WordPress plugin before version 4.7.19 does not properly escape the slider's after-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser of anyone (including an administrator) who views the slider.

The Ultimate Before After Image Slider & Gallery WordPress plugin before version 4.7.1 does not escape the value of the BEAF Slider widget's shortcode field before outputting it on the front end. The value is passed through do_shortcode, which echoes non-shortcode content verbatim, allowing users with administrator-level access to store a script that executes in the browser of any visitor who loads a page displaying the widget.