CVE-2025-15664: CWE-79 Cross-Site Scripting (XSS) in Ultimate Before After Image Slider & Gallery

The Ultimate Before After Image Slider & Gallery WordPress plugin versions prior to 4.7.19 contain a stored cross-site scripting vulnerability (CWE-79). The issue arises because the plugin does not properly escape the 'before-label' value of the slider before it is re-inserted into the DOM by its client-side script. This flaw enables users with Author role or above to inject JavaScript payloads that execute in the context of other users viewing the slider, potentially leading to high impact such as credential theft or session hijacking.

Successful exploitation allows an attacker with Author or higher privileges to inject malicious scripts that execute in the browsers of other users, including administrators. This can lead to full compromise of user accounts, data theft, and potentially site takeover. The CVSS score of 6.8 reflects a medium severity with high confidentiality, integrity, and availability impacts, requiring user interaction and privileges to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author role capabilities to trusted users only and avoid viewing untrusted slider content. Monitor vendor channels for updates and apply patches promptly once released.