Before After Image EUVD-2026-96469

Exploitation requires the vulnerable Before After Image Comparison - Image Comparison for WP plugin (version 1.1.21 or earlier) to be installed and active on a WordPress site, and requires a victim to interact with an attacker-supplied payload (UI:R) - typically a logged-in administrator or site visitor clicking a crafted link or loading an attacker-influenced page. No authentication is needed to deliver the payload (PR:N), but the mandatory user interaction and the requirement that the specific plugin be present and exposed are the key factors limiting realistic exploitation; sites not running this plugin are unaffected.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1 HIGH) describes a network-reachable, low-complexity, unauthenticated reflected/stored cross-site scripting flaw (CWE-79) that requires victim interaction (UI:R) and crosses a security scope boundary (S:C) with limited confidentiality, integrity, and availability impact. No EPSS score was supplied, the CVE is NOT listed in CISA KEV, and no public proof-of-concept is referenced, so exploitation status is 'no public exploit identified at time of analysis.' Real-world risk is moderate and lower than the 7.1 headline suggests: XSS requires tricking an authenticated administrator or a visitor into loading an attacker-controlled payload, limiting it to targeted rather than automated mass exploitation. The only intelligence source is Patchstack; without EPSS or active-exploitation signals, this is best treated as a routine patch-when-convenient issue for sites running the affected plugin rather than an emergency, though the unauthenticated nature (PR:N) raises its relative priority among XSS bugs.

An attacker crafts a malicious URL or page input containing JavaScript that the Before After Image Comparison plugin (version 1.1.21 or earlier) reflects or stores without proper sanitization. When a logged-in WordPress administrator or site visitor is lured into loading the payload, the script executes in their browser session, enabling session/cookie theft or actions on their behalf. No authentication is required to deliver the payload (PR:N), but victim interaction is mandatory (UI:R), and no public exploit code has been identified at time of analysis.