Before After Image Comparison Image Comparison For Wp
Monthly
Unauthenticated cross-site scripting in the WordPress plugin Before After Image Comparison - Image Comparison for WP (versions 1.1.21 and earlier) allows a remote attacker to deliver a crafted payload that executes JavaScript in a victim's browser, but only after that victim interacts with the attacker-supplied link or page (CVSS 3.1 base 7.1, HIGH). The vulnerable plugin must be installed and active on the target WordPress site for any exploitation to be possible; sites not running it are unaffected. At the time of analysis there is no confirmed in-the-wild exploitation (not in CISA KEV) and no public exploit code identified, and no EPSS score was supplied, so the practical risk is governed mainly by the mandatory user interaction and the need for the specific plugin to be present and reachable.
Authenticated low-privilege users on WordPress sites running the bPlugins 'Before After Image Comparison - Image comparison for WP' plugin (all versions through 1.1.21) can reach plugin functionality that lacks proper authorization checks, allowing them to read and alter data the plugin is intended to restrict (CWE-862, CVSS 5.4). The defect is remotely reachable over the network with no user interaction (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), so any site that allows self-registration or hosts multiple untrusted accounts provides the necessary foothold, while single-administrator sites with no untrusted users face minimal realistic exposure. No public exploit code was identified at time of analysis and there is no confirmed active exploitation, but the low privilege prerequisite and network reachability make the prerequisite account easy to obtain on open-registration deployments.
Unauthenticated cross-site scripting in the WordPress plugin Before After Image Comparison - Image Comparison for WP (versions 1.1.21 and earlier) allows a remote attacker to deliver a crafted payload that executes JavaScript in a victim's browser, but only after that victim interacts with the attacker-supplied link or page (CVSS 3.1 base 7.1, HIGH). The vulnerable plugin must be installed and active on the target WordPress site for any exploitation to be possible; sites not running it are unaffected. At the time of analysis there is no confirmed in-the-wild exploitation (not in CISA KEV) and no public exploit code identified, and no EPSS score was supplied, so the practical risk is governed mainly by the mandatory user interaction and the need for the specific plugin to be present and reachable.
Authenticated low-privilege users on WordPress sites running the bPlugins 'Before After Image Comparison - Image comparison for WP' plugin (all versions through 1.1.21) can reach plugin functionality that lacks proper authorization checks, allowing them to read and alter data the plugin is intended to restrict (CWE-862, CVSS 5.4). The defect is remotely reachable over the network with no user interaction (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), so any site that allows self-registration or hosts multiple untrusted accounts provides the necessary foothold, while single-administrator sites with no untrusted users face minimal realistic exposure. No public exploit code was identified at time of analysis and there is no confirmed active exploitation, but the low privilege prerequisite and network reachability make the prerequisite account easy to obtain on open-registration deployments.