EUVD-2025-210823
GHSA-w7c4-c6pr-wv3j
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Author role is low-privilege (PR:L), payload executes in a different user's browser (S:C), with typical XSS confidentiality and integrity impact on that session (C:L/I:L); no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's after-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser of anyone (including an administrator) who views the slider.
AnalysisAI
Stored cross-site scripting in the Ultimate Before After Image Slider & Gallery WordPress plugin (all versions before 4.7.19) allows users holding the Author role or above to embed a persistent browser payload in a slider's after-label field, which executes in every visitor's browser - including site administrators - when the slider is rendered. The plugin's bundled client-side script re-injects the stored label value directly into the DOM without HTML encoding. A publicly available exploit exists per WPScan, making this a practical privilege-escalation path on any WordPress site granting Author access to untrusted users.
Technical ContextAI
The flaw is a stored XSS (CWE-79: Improper Neutralization of Input During Web Page Generation) rooted in the plugin's client-side rendering logic. Rather than sanitizing or escaping the slider's after-label value at output time, the bundled JavaScript retrieves the stored value and inserts it into the DOM via an unsafe method (e.g., innerHTML assignment), bypassing WordPress's server-side sanitization. The affected CPE is cpe:2.3:a:unknown:ultimate_before_after_image_slider_&_gallery:*:*:*:*:*:*:*:* (vendor field unresolved in NVD), covering all releases before 4.7.19. The hybrid nature - server-stored payload, DOM-injected execution - means content security policies and server-side filters alone may not neutralize it if client-side output escaping is absent.
RemediationAI
Update the Ultimate Before After Image Slider & Gallery plugin to version 4.7.19 or later, available through the standard WordPress plugin repository - this is the vendor-confirmed fix. If immediate patching is not possible, the most targeted compensating control is to restrict Author-role users from creating or editing sliders by adjusting plugin capabilities via a role-management plugin (e.g., Members or User Role Editor); this removes the attack surface without disabling the plugin for editors and administrators. Alternatively, temporarily deactivating the plugin eliminates the risk entirely but removes all slider functionality site-wide. Restricting content creation by Author-level untrusted accounts at the WordPress configuration level is also effective.
Unrestricted Upload of File with Dangerous Type vulnerability in Themefic BEAF allows Upload a Web Shell to a Web Server
Stored cross-site scripting in the Ultimate Before After Image Slider & Gallery WordPress plugin before version 4.7.19 e
Stored cross-site scripting in the Ultimate Before After Image Slider & Gallery WordPress plugin (all versions before 4.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today