Before After Slider CVE-2025-15663

The attacker must hold at minimum the WordPress Author role on the target site (authenticated, low privilege). The victim must load a WordPress page or post containing the malicious slider in their browser (passive user interaction required). The Ultimate Before After Image Slider & Gallery plugin must be installed, active, and the attacker must have permission to create or edit sliders (default for Authors). No non-default plugin configuration or special server-side setting is required - the flaw exists in the default slider-rendering path. Exploitation is bounded to sites where Author-level access is granted to untrusted parties; single-operator or fully-trusted-team sites face negligible risk. No network-level controls can prevent exploitation once a payload is stored, as execution is client-side.

The vendor-assigned CVSS 6.8 vector (AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) contains a notable inconsistency: PR:H implies administrator-level access, yet the description explicitly states the Author role (a low-privilege WordPress role) is sufficient - PR:L is more accurate. Additionally, S:U conflicts with the cross-user impact model: the payload executes in a different user's browser (scope change), making S:C the correct designation. A corrected vector (PR:L/S:C) changes the risk framing significantly - this is not a high-privilege-required, same-scope issue but rather a low-privilege privilege-escalation vector. No EPSS score or CISA KEV listing is provided, but a publicly available PoC via WPScan lowers the bar for exploitation. Realistic priority: high for multi-author sites where untrusted users hold Author-level roles; low for single-author or fully-trusted team sites.

An attacker with WordPress Author credentials edits an existing slider (or creates a new one) and sets the after-label to a JavaScript payload that exfiltrates the document.cookie value to an attacker-controlled server. When a site administrator later views any post embedding that slider, the plugin's client-side script injects the unescaped label into the DOM, the payload fires silently, and the admin's session token is delivered to the attacker - enabling full site takeover. A publicly available PoC on WPScan makes this exploitation straightforward without requiring advanced JavaScript knowledge.