CVE-2025-15664: BEAF < 4.7.19 - Author+ Stored XSS via Before Label

Q: Which users can create a malicious slider, and who is at risk when it is viewed?

Users with the Author role or higher can store the malicious before-label value. The payload executes in the browser of anyone who views the affected slider, including administrators.

Q: How can I determine whether an installation is affected?

Installations using Ultimate Before After Image Slider & Gallery versions earlier than 4.7.19 are affected. Review sliders created by Author-level or higher users for untrusted content in their before-label values.

Published Sep 2, 2026

Updated

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's before-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser of anyone (including an administrator) who views the slider.

Affected Software

1 affected component

WordPress plugin "Ultimate Before After Image Slider & Gallery"<4.7.19

Event History

Sep 2, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which users can create a malicious slider, and who is at risk when it is viewed?

Users with the Author role or higher can store the malicious before-label value. The payload executes in the browser of anyone who views the affected slider, including administrators.

How can I determine whether an installation is affected?

Installations using Ultimate Before After Image Slider & Gallery versions earlier than 4.7.19 are affected. Review sliders created by Author-level or higher users for untrusted content in their before-label values.