CVE-2025-15664

Name of the Vulnerable Software and Affected Versions The Ultimate Before After Image Slider & Gallery versions prior to 4.7.19

Description The plugin fails to properly escape the before-label value of the slider. This allows users with the Author role or higher to store a malicious payload that is subsequently re-injected into the Document Object Model (DOM) by a bundled client-side script. This results in the execution of the payload in the browser of any user, including administrators, who views the slider.

Recommendations Update The Ultimate Before After Image Slider & Gallery to version 4.7.19 or later.