CVE-2025-15665: CWE-79 Cross-Site Scripting (XSS) in Ultimate Before After Image Slider & Gallery
The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.1 does not escape the value of the BEAF Slider widget's shortcode field before outputting it on the front end (the value is passed through do_shortcode, which echoes non-shortcode content verbatim), allowing users with administrator-level access to store a script that executes in the browser of any visitor who loads a page displaying the widget.
AI Analysis
Technical Summary
The Ultimate Before After Image Slider & Gallery WordPress plugin versions prior to 4.7.1 do not escape the value of the BEAF Slider widget's shortcode field before rendering it on the front end. The value is processed through do_shortcode, which outputs non-shortcode content verbatim, enabling an administrator to store malicious scripts. These scripts then execute in the browsers of any visitors who load a page containing the widget, constituting a stored Cross-Site Scripting (CWE-79) vulnerability.
Potential Impact
An attacker with administrator privileges can inject arbitrary JavaScript code via the shortcode field of the BEAF Slider widget. This script executes in the context of any visitor's browser who views the affected page, potentially leading to session hijacking, defacement, or other malicious actions executed in the victim's browser.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only to reduce the risk of exploitation. Monitor official plugin channels for updates addressing this vulnerability.
CVE-2025-15665: CWE-79 Cross-Site Scripting (XSS) in Ultimate Before After Image Slider & Gallery
Description
The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.1 does not escape the value of the BEAF Slider widget's shortcode field before outputting it on the front end (the value is passed through do_shortcode, which echoes non-shortcode content verbatim), allowing users with administrator-level access to store a script that executes in the browser of any visitor who loads a page displaying the widget.
CVSS v3.1
Score 5.4medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Ultimate Before After Image Slider & Gallery WordPress plugin versions prior to 4.7.1 do not escape the value of the BEAF Slider widget's shortcode field before rendering it on the front end. The value is processed through do_shortcode, which outputs non-shortcode content verbatim, enabling an administrator to store malicious scripts. These scripts then execute in the browsers of any visitors who load a page containing the widget, constituting a stored Cross-Site Scripting (CWE-79) vulnerability.
Potential Impact
An attacker with administrator privileges can inject arbitrary JavaScript code via the shortcode field of the BEAF Slider widget. This script executes in the context of any visitor's browser who views the affected page, potentially leading to session hijacking, defacement, or other malicious actions executed in the victim's browser.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only to reduce the risk of exploitation. Monitor official plugin channels for updates addressing this vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-06-23T11:11:48.893Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a55d15368715ace43daafb0
Added to database: 07/14/2026, 06:04:03 UTC
Last enriched: 07/14/2026, 06:18:09 UTC
Last updated: 07/15/2026, 02:31:59 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.