Skip to content
Sign in
6.8 Medium

CVE-2025-15663 The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's…

Description

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's after-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser of anyone (including an administrator) who views the slider.

Affected products and versions

Product Affected versions Fixed in
Ultimate Before After Image Slider & Gallery 4.7 earliest → < 4.7.19 4.7.19

Other CVEs of Ultimate Before After Image Slider & Gallery

The 3 CVEs of Ultimate Before After Image Slider & Gallery →
CVE-2025-15664 The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's… 6.8 Medium CVE-2025-15665 The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.1 does not escape the value of the BEAF… 5.4 Medium
Track this CVE