CVE-2025-15664: WordPress Before After Slider XSS Flaw

CVE-2025-15664 Overview

CVE-2025-15664 is a stored cross-site scripting (XSS) vulnerability in the Ultimate Before After Image Slider & Gallery WordPress plugin before version 4.7.19. The plugin fails to escape the slider's before-label value before its bundled client-side script re-injects it into the Document Object Model (DOM). Authenticated users with the Author role or higher can store a malicious payload that executes in the browser of anyone who views the slider, including administrators. This creates a viable path to session theft and administrative account takeover on affected WordPress sites.

Critical Impact
An authenticated Author can plant a persistent JavaScript payload that executes with administrator privileges when the slider is rendered, enabling site takeover.

Affected Products

Ultimate Before After Image Slider & Gallery WordPress plugin versions before 4.7.19
WordPress sites permitting Author-level (or higher) user registration
Any front-end or admin page rendering an affected slider instance

Discovery Timeline

2026-09-02 - CVE-2025-15664 published to the National Vulnerability Database (NVD)
2026-09-02 - Last updated in the NVD database

Technical Details for CVE-2025-15664

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw classified under CWE-79. The plugin accepts a before-label string when an Author or higher-privileged user configures a slider. That string is persisted in the WordPress database without sufficient escaping. When the slider renders, the plugin's bundled client-side JavaScript reads the stored label and injects it back into the DOM using an unsafe sink such as innerHTML. Any attacker-controlled markup in that value is parsed and executed by the victim's browser.

Because the payload fires whenever the slider loads, an administrator who previews or edits an affected slider triggers the attacker's script. That script runs in the administrator's authenticated session and can create new administrator accounts, modify plugin or theme files, or exfiltrate session cookies.

Root Cause

The root cause is improper output encoding on a stored user-supplied field. Server-side output filtering alone is insufficient because the client-side script re-hydrates the value into HTML context. Neither the server nor the client sanitizes the label before it reaches an HTML sink, so raw script content is executed on render.

Attack Vector

Exploitation requires an authenticated account with the Author role or above and a subsequent view of the slider by another user. The attacker edits a slider, places a JavaScript payload in the before-label field, and saves the configuration. When a higher-privileged user, typically an administrator, loads a page containing that slider, the script executes in their browser context. See the WPScan vulnerability analysis for additional technical detail.

Detection Methods for CVE-2025-15664

Indicators of Compromise

Slider before-label fields in the wp_postmeta or plugin-specific tables containing <script>, onerror=, onload=, or javascript: substrings
Unexpected creation of new administrator accounts or changes to existing user roles following slider views
Outbound requests from browsers loading slider pages to unknown external domains
Plugin or theme file modifications performed from admin sessions that did not initiate a manual change

Detection Strategies

Audit stored slider configuration values for HTML tags, event handlers, and encoded script fragments
Enable Content Security Policy (CSP) reporting and review violations tied to inline script execution on slider pages
Review WordPress access logs for Author-level POST requests to plugin AJAX endpoints and admin-ajax handlers that update slider labels

Monitoring Recommendations

Alert on new administrator account creation and privilege changes in wp_users and wp_usermeta
Monitor the WordPress plugin directory for unauthorized file writes originating from admin sessions
Track outbound HTTP requests from browser sessions of privileged users for anomalous destinations

How to Mitigate CVE-2025-15664

Immediate Actions Required

Upgrade the Ultimate Before After Image Slider & Gallery plugin to version 4.7.19 or later on every WordPress site
Audit all existing sliders and remove any before-label values that contain HTML or script content
Review the Author, Editor, and Administrator user lists and revoke accounts that are no longer required
Rotate credentials for administrator accounts that may have viewed a compromised slider

Patch Information

The vendor addressed the flaw in version 4.7.19 by properly escaping the slider's before-label value before it is re-injected into the DOM by the bundled client-side script. Site owners should install the update through the WordPress plugin manager or by uploading the fixed release. Consult the WPScan advisory for release details.

Workarounds

Restrict slider configuration capabilities to trusted Administrator accounts using a role management plugin until the patch is applied
Deploy a web application firewall rule that blocks POST requests containing script markup to the plugin's slider update endpoints
Apply a strict Content Security Policy that disallows inline script execution on pages that render sliders

bash

# Update the plugin from the WordPress CLI
wp plugin update ultimate-before-after-image-slider-gallery --version=4.7.19
wp plugin list --name=ultimate-before-after-image-slider-gallery --fields=name,status,version