Vulnerability · Published Jul 14, 2026 · Assigned by WPScan

CVE-2025-15665BEAF < 4.7.1 - Admin+ Stored XSS via Widget Shortcode Field

Medium 5.4

In plain English

A medium-severity security flaw in Ultimate Before After Image Slider & Gallery from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 86.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.1 does not escape the value of the BEAF Slider widget's shortcode field before outputting it on the front end (the value is passed through do_shortcode, which echoes non-shortcode content verbatim), allowing users with administrator-level access to store a script that executes in the browser of any visitor who loads a page displaying the widget.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Ultimate Before After Image Slider & Gallery	0 – before 4.7.1

References

https://wpscan.com/vulnerability/754f0960-efc8-426f-bb1d-7cceec920910/ exploit, vdb-entry, technical-description