Ultimate Before After Image Slider & Gallery CVE-2025-15664

The attacker must hold at minimum an Author-level WordPress account on the targeted site - unauthenticated exploitation is not possible. The Ultimate Before After Image Slider & Gallery plugin must be installed, activated, and at a version below 4.7.19. The stored payload only executes when a victim browses to a page or post that renders a slider containing the malicious label; exploitation against an administrator additionally requires that administrator to view such a page during an authenticated session. Non-default conditions that limit exploitation include: sites where the Author role is restricted to a small, trusted set of users; sites where sliders are never shown on publicly accessible or admin-visible pages; and sites running version 4.7.19 or later.

CVSS 6.8 with PR:H reflects the provided score, yet Author-level access in WordPress is broadly accessible on multi-author blogs and content platforms - the practical barrier to entry is lower than a strict PR:H reading implies, and even a mid-sized municipal IT team in swidnica running a public-facing WordPress site should treat this as a meaningful priority if the plugin is installed. The UI:R condition (an administrator or other user must view the slider) reduces the chance of opportunistic mass exploitation, but it is trivially satisfied on any live site that displays sliders on public-facing pages. A publicly available exploit from WPScan confirms that attack code is not theoretical. EPSS score is not provided in the input, so exploitation probability cannot be compared against the KEV baseline. The S:U / C:H / I:H / A:H in the provided vector is aggressive for a browser-context XSS without a documented scope escalation path; realistically, impact centers on session hijacking and admin-level WordPress takeover rather than full server compromise. No KEV listing exists, suggesting no confirmed wide exploitation to date. Overall: elevated real-world risk on multi-author WordPress deployments with public sliders; lower risk on single-author or admin-only installations.

An attacker with a legitimate Author account on a WordPress site edits or creates a before/after image slider and inserts a JavaScript payload into the before-label field. When any site visitor or logged-in administrator navigates to a page containing that slider, the plugin's client-side script injects the unescaped label into the DOM, causing the payload to execute in the victim's browser and enabling session cookie theft or unauthorized admin actions. A publicly available proof-of-concept from WPScan demonstrates this attack path.