CVE-2025-15665 Overview
CVE-2025-15665 is a stored Cross-Site Scripting (XSS) vulnerability in the Ultimate Before After Image Slider & Gallery WordPress plugin, affecting versions prior to 4.7.1. The plugin fails to escape the value of the BEAF Slider widget's shortcode field before rendering it on the front end. The unsanitized value passes through do_shortcode, which echoes non-shortcode content verbatim to the page.
An authenticated user with administrator-level access can inject arbitrary JavaScript that executes in the browser of any visitor loading a page containing the widget. The flaw is categorized under [CWE-79] Improper Neutralization of Input During Web Page Generation.
Critical Impact
Stored JavaScript payloads execute in visitor browsers, enabling session theft, credential harvesting, and drive-by redirection from trusted WordPress sites.
Affected Products
- Ultimate Before After Image Slider & Gallery WordPress plugin versions prior to 4.7.1
- WordPress sites using the BEAF Slider widget shortcode field
- Front-end pages rendering the affected widget to unauthenticated visitors
Discovery Timeline
- 2026-07-14 - CVE-2025-15665 published to NVD
- 2026-07-14 - Last updated in NVD database
Technical Details for CVE-2025-15665
Vulnerability Analysis
The vulnerability resides in the rendering logic of the BEAF Slider widget. Administrator-supplied input in the shortcode field is stored in the WordPress database and later output to the front end without HTML escaping. The plugin passes the stored value through WordPress's do_shortcode function, which processes recognized shortcodes but echoes non-shortcode content directly to the response body.
Because the value bypasses escape functions such as esc_html or esc_attr, any HTML or JavaScript embedded in the field is rendered as active markup. This produces a persistent (stored) XSS condition triggered on every page load containing the widget.
Root Cause
The root cause is missing output encoding on a widget attribute that accepts free-form text. WordPress requires explicit escaping at the point of output, but the plugin relies on do_shortcode as a passthrough. Non-shortcode substrings, including <script> tags and event handler attributes, are echoed verbatim into the DOM.
Attack Vector
An attacker with administrator privileges configures the BEAF Slider widget with a shortcode field value containing a JavaScript payload. The malicious markup persists in the database. Every unauthenticated or authenticated visitor who loads a page containing the widget executes the payload in their browser session under the site's origin.
Because the attacker must already hold administrator access, exploitation typically follows a compromised admin account, a rogue insider, or a multi-tenant WordPress deployment where administrator roles are delegated across trust boundaries. Refer to the WPScan Vulnerability Report for additional technical detail.
Detection Methods for CVE-2025-15665
Indicators of Compromise
- Unexpected <script> tags, onerror, or onload attributes stored in WordPress wp_options or widget metadata for BEAF Slider entries
- Outbound requests from visitor browsers to attacker-controlled domains originating from pages hosting the widget
- Anomalous administrator-account edits to BEAF Slider widget configurations outside normal change windows
Detection Strategies
- Audit WordPress database rows containing BEAF widget shortcode values for HTML tags, JavaScript keywords, or encoded payloads
- Deploy a Web Application Firewall (WAF) rule to inspect rendered pages for script content injected via widget output
- Correlate administrator login events with subsequent widget configuration changes to identify suspicious sequences
Monitoring Recommendations
- Enable WordPress audit logging for widget and shortcode modifications by privileged users
- Monitor Content Security Policy (CSP) violation reports for inline script execution on pages containing the widget
- Track unusual referer patterns or client-side error telemetry from visitor sessions on affected pages
How to Mitigate CVE-2025-15665
Immediate Actions Required
- Upgrade the Ultimate Before After Image Slider & Gallery plugin to version 4.7.1 or later
- Review all existing BEAF Slider widget configurations for embedded scripts or suspicious markup and remove malicious content
- Rotate credentials for administrator accounts and enforce multi-factor authentication on the WordPress admin panel
Patch Information
The vendor released version 4.7.1 of the plugin, which escapes the shortcode field value before output. Update through the WordPress plugin management console or via WP-CLI. Confirm the installed version matches or exceeds 4.7.1 across all sites in multi-site deployments.
Workarounds
- Restrict administrator role assignments to trusted personnel and remove unused privileged accounts
- Deactivate the BEAF Slider widget until the plugin is updated if immediate patching is not feasible
- Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
# Update the plugin via WP-CLI
wp plugin update ultimate-before-after-slider --version=4.7.1
# Verify installed version
wp plugin get ultimate-before-after-slider --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
