Cross-Site Scripting Flaw in Ultimate Before After Image Slider & Gallery Plugin by WordPress
CVE-2025-15665
Currently unrated
What is CVE-2025-15665?
The Ultimate Before After Image Slider & Gallery plugin for WordPress versions prior to 4.7.1 is susceptible to a cross-site scripting vulnerability. This issue arises because the plugin fails to properly escape the shortcode field when outputting the value of the BEAF Slider widget. As a result, an attacker with administrator-level access can insert malicious scripts that will execute in the browsers of users visiting a page displaying the widget, potentially leading to unauthorized actions and data breaches.
Affected Version(s)
Ultimate Before After Image Slider & Gallery 0 < 4.7.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.