CVE-2025-15663: CWE-79 Cross-Site Scripting (XSS) in Ultimate Before After Image Slider & Gallery

The Ultimate Before After Image Slider & Gallery WordPress plugin before version 4.7.19 contains a stored cross-site scripting vulnerability (CWE-79). The vulnerability occurs due to improper escaping of the slider's after-label value before it is re-inserted into the DOM by the plugin's client-side script. This enables users with Author role or above to inject malicious payloads that execute in the browsers of other users who view the slider, potentially leading to full compromise of confidentiality, integrity, and availability of affected user sessions.

Successful exploitation allows an authenticated user with Author or higher privileges to inject malicious scripts that execute in the browsers of other users, including administrators. This can lead to complete compromise of user sessions, data theft, or further attacks within the WordPress environment. The CVSS score of 6.8 reflects a medium severity with high impact on confidentiality, integrity, and availability.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict Author role privileges where possible and avoid viewing sliders created by untrusted users. Monitor vendor channels for updates and apply patches promptly once available.