EUVD-2025-210822
GHSA-jmj2-wp2q-8p2g
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Author role is low privilege (PR:L); XSS crosses into victim browser scope (S:C); no availability impact; C:L/I:L per scope-change convention.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's before-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser of anyone (including an administrator) who views the slider.
AnalysisAI
Stored cross-site scripting in the Ultimate Before After Image Slider & Gallery WordPress plugin before version 4.7.19 enables any authenticated user holding the Author role or higher to plant a malicious JavaScript payload within a slider's before-label field. Because the plugin's bundled client-side script re-injects that label value into the DOM without sanitization, the payload executes automatically in the browser of every visitor - including administrators - who views the affected slider. A publicly available proof-of-concept was published by WPScan; vendor-released patch version 4.7.19 is available, and no active exploitation has been confirmed in the CISA KEV catalog.
Technical ContextAI
The vulnerability resides in the WordPress plugin identified in CPE as cpe:2.3:a:unknown:ultimate_before_after_image_slider_&_gallery. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a DOM-based stored XSS pattern: user-controlled data - in this case the slider's 'before-label' field - is saved to the database without adequate server-side sanitization, and the plugin's own JavaScript then reads that stored value and writes it back into the live DOM at render time without HTML-encoding it. This reflects a failure at two layers: the server does not reject or encode the input on save, and the client-side script does not treat the retrieved value as untrusted data. The affected versions cover all releases before 4.7.19.
RemediationAI
The primary fix is to upgrade the Ultimate Before After Image Slider & Gallery plugin to version 4.7.19 or later, which introduces proper escaping of the before-label value before it is re-injected by the client-side script. Site administrators should update immediately via the WordPress plugin dashboard or by downloading from the official plugin repository. If immediate upgrade is not possible, a compensating control is to restrict the Author role so that only fully trusted users hold it - removing Author-level accounts for untrusted contributors reduces the attack surface but does not eliminate the vulnerability. Alternatively, deactivating or removing the plugin until the patch can be applied removes the risk entirely, with the obvious trade-off of losing slider functionality. The WPScan advisory at https://wpscan.com/vulnerability/31bfd4c6-32e8-4790-b9a8-949fdaba9454/ and NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2025-15664 provide additional context.
Unrestricted Upload of File with Dangerous Type vulnerability in Themefic BEAF allows Upload a Web Shell to a Web Server
Stored cross-site scripting in the Ultimate Before After Image Slider & Gallery WordPress plugin (all versions before 4.
Stored cross-site scripting in the Ultimate Before After Image Slider & Gallery WordPress plugin (all versions before 4.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today