CVE-2025-15665

Name of the Vulnerable Software and Affected Versions The Ultimate Before After Image Slider & Gallery versions prior to 4.7.1

Description Insufficient input sanitization and output escaping in the BEAF Slider widget's shortcode field allow users with administrator-level access to perform Stored Cross-Site Scripting (XSS). The issue occurs because the value is passed through do shortcode(), which echoes non-shortcode content verbatim on the front end. This allows the storage of scripts that execute in the browser of any visitor loading the affected page. This issue specifically affects multi-site installations and environments where unfiltered html has been disabled.

Recommendations Update to version 4.7.1 or later.