CVE-2025-15663: WordPress Before After Slider XSS Flaw

CVE-2025-15663 Overview

CVE-2025-15663 is a stored Cross-Site Scripting (XSS) vulnerability in the Ultimate Before After Image Slider & Gallery WordPress plugin before version 4.7.19. The plugin fails to properly escape the slider's after-label value before its bundled client-side script re-injects the value into the Document Object Model (DOM). Authenticated users with the Author role or above can store a payload that executes in the browser of any visitor who views the affected slider, including administrators.

Critical Impact
Attackers with Author-level access can hijack administrator sessions, escalate privileges, and pivot to full site compromise through stored script execution.

Affected Products

Ultimate Before After Image Slider & Gallery WordPress plugin
All versions prior to 4.7.19
WordPress sites permitting Author-role account creation or delegation

Discovery Timeline

2026-09-02 - CVE-2025-15663 published to the National Vulnerability Database (NVD)
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2025-15663

Vulnerability Analysis

The vulnerability is a stored XSS flaw classified under [CWE-79], Improper Neutralization of Input During Web Page Generation. The plugin accepts a user-controlled after-label string associated with slider content. When the bundled front-end script renders the slider, it re-injects this string into the DOM without applying output encoding or sanitization. A crafted payload therefore executes as JavaScript in the context of the WordPress site whenever the slider loads.

Because the payload executes in an administrator's browser session, an attacker can perform any action available to that administrator. This includes creating new privileged accounts, modifying plugin or theme files, and injecting persistent backdoors. The Author role requirement raises the exploitation bar but remains realistic on multi-author sites and platforms that permit contributor sign-ups.

Root Cause

The root cause is missing output escaping in the client-side rendering logic. The plugin trusts the stored after-label value and inserts it into the DOM using an unsafe method such as innerHTML assignment instead of textContent or a sanitizer. Server-side storage without contextual escaping compounds the issue by preserving the raw payload across page loads.

Attack Vector

An authenticated attacker with the Author role or higher edits a slider and supplies a malicious after-label containing script content. The payload persists in the WordPress database. When any user renders a page containing the slider, the plugin script re-injects the label into the DOM and the browser executes the embedded JavaScript. The attack requires user interaction to view the slider and yields high impact to confidentiality, integrity, and availability once triggered.

Exploitation details and payload structure are documented in the WPScan Vulnerability Report.

Detection Methods for CVE-2025-15663

Indicators of Compromise

Slider after-label fields in the WordPress database containing <script>, onerror=, onload=, or JavaScript URI schemes
Unexpected administrator accounts created shortly after slider content was edited by lower-privileged users
Outbound requests from administrator browsers to attacker-controlled domains coinciding with slider page loads

Detection Strategies

Audit the wp_postmeta and plugin option tables for slider records containing HTML tags or event-handler attributes
Review WordPress audit logs for slider edits performed by Author-role accounts before the plugin was patched
Inspect Content Security Policy (CSP) violation reports for inline script executions on pages hosting sliders

Monitoring Recommendations

Enable a Web Application Firewall (WAF) rule set that flags script-like content submitted to plugin endpoints
Log and alert on privileged actions such as user role changes, plugin installations, and file edits
Monitor administrator session activity for anomalous DOM interactions or unexpected XHR requests to external hosts

How to Mitigate CVE-2025-15663

Immediate Actions Required

Update the Ultimate Before After Image Slider & Gallery plugin to version 4.7.19 or later
Review all existing slider entries and remove any content containing HTML or script fragments in label fields
Rotate administrator credentials and invalidate active sessions if suspicious slider edits are found

Patch Information

The vendor addressed the flaw in version 4.7.19 by enforcing output escaping on the after-label value before DOM injection. Patch details and remediation guidance are available in the WPScan Vulnerability Report.

Workarounds

Restrict slider editing capabilities to Editor or Administrator roles using a capability management plugin until the update is applied
Deploy a strict CSP that disallows inline scripts on pages that render sliders
Temporarily deactivate the plugin on sites that grant Author-role access to untrusted users

bash

# Update the plugin via WP-CLI
wp plugin update ultimate-before-after-image-slider-and-gallery --version=4.7.19
wp plugin list --name=ultimate-before-after-image-slider-and-gallery --fields=name,status,version