BEAF Gallery Plugin CVE-2025-15665

Exploitation requires the attacker to hold an authenticated administrator-level account on the target WordPress site - this is the primary limiting factor and substantially constrains opportunistic mass exploitation. The BEAF Slider widget must be actively placed on at least one publicly accessible page or post for the stored payload to reach victims. Victim-side triggering requires a user (any role, including unauthenticated visitors) to load the page displaying the compromised widget (UI:R per CVSS). The vulnerability is not exploitable by lower-privileged WordPress roles such as Editor, Author, or Subscriber. There is no special server-side configuration or non-default setting required beyond the plugin being installed and a BEAF Slider widget being deployed on a page.

The NVD CVSS 3.1 score of 5.4 Medium uses AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N; however, the CVE description explicitly states 'users with administrator-level access,' which maps more accurately to PR:H rather than PR:L in standard CVSS terminology - this discrepancy should be verified against the vendor advisory. The Changed scope (S:C) correctly reflects that the injected payload executes in a victim browser context separate from the WordPress application itself. SSVC classifies the exploitation status as poc-level, not automatable, with partial technical impact - consistent with the access-gated nature of the flaw. No EPSS score was provided in the intelligence data, and the absence of a KEV listing indicates no confirmed widespread active exploitation. The public POC published by WPScan lowers the barrier for exploitation but the administrator-privilege prerequisite substantially narrows the realistic threat pool to malicious insiders, compromised admin accounts, or social-engineering scenarios. This is a genuine but moderate-priority remediation item, particularly elevated in WordPress multisite deployments where sub-site administrators are less fully trusted.

A malicious or compromised WordPress administrator navigates to the BEAF Slider widget settings and enters a JavaScript payload (e.g., a cookie-stealing script) into the shortcode field, then publishes or updates the page. Every subsequent visitor who loads that page receives the injected script executed in their browser context, enabling session hijacking, credential harvesting, or drive-by malware delivery. A public proof-of-concept for this technique has been disclosed by WPScan, making reproduction straightforward for any attacker who has obtained WordPress admin credentials.