The Ultimate Before After Image Slider & Gallery – BEAF plugin is a popular before/after image comparison slider used on more than 30,000 active WordPress sites. During security testing a stored Cross-Site Scripting flaw was found and assigned CVE-2025-15663: a user with the Author role or higher can inject persistent JavaScript through the slider’s After Label field. Once the slider is embedded on a page, the payload executes in the browser of every visitor and administrator who views it, opening the door to administrator account takeover. The issue affects all versions below 4.7.19 and is fixed in 4.7.19.
| CVE | CVE-2025-15663 |
| Ultimate Before After Image Slider & Gallery – BEAF < 4.7.19 | |
| All Time | 1 124 757 |
| Active installations | 30 000+ |
| Publicly Published | August 31, 2026 |
| Last Updated | August 31, 2026 |
| Researcher | Krugov Artyom |
| OWASP TOP-10 | A03:2021 – Injection (Cross-Site Scripting) |
| CWE | CWE-79 |
| PoC | Yes |
| Exploit | No |
| Reference | https://www.cve.org/CVERecord?id=CVE-2025-15663 https://wpscan.com/vulnerability/56dd063a-c097-4fed-83bc-99799b4a229d/ |
| Logo of the plugin |  |
PSC by CleantalkJoin the community of developers who prioritize security. Highlight your plugin in the WordPress catalog.
Timeline
| February 12, 2025 | Plugin testing and vulnerability detection in the Ultimate Before After Image Slider & Gallery – BEAF have been completed |
| February 12, 2026 | I contacted the author of the plugin and provided a vulnerability PoC with a description and recommendations for fixing |
| August 24, 2026 | The vendor released the patched version 4.7.19 |
| August 31, 2026 | Registered CVE-2025-15663 |
Discovery of the Vulnerability
While auditing the slider editor of the BEAF plugin, I found that the After Label option — the caption shown over the “after” image of a before/after slider — is not sanitized on input and not escaped on output. The slider is created in the plugin panel Before and After Slider: the “before” image is set on the Content tab and the label text on the Options tab. Whatever is typed into the After Label is stored in the database as-is and later written back into the DOM by the plugin’s front-end script when the slider’s shortcode is rendered on a page. Because the value is reflected into an HTML attribute context without escaping, a crafted label breaks out of the attribute and injects executable markup — a classic Stored XSS. Any account with the Author capability (create posts and use the slider shortcode) is enough to plant it.
Understanding of Stored XSS attacks
Stored (persistent) Cross-Site Scripting is one of the most dangerous web vulnerabilities because the malicious payload is saved on the server and served to every user who opens the affected page — no phishing link or social engineering is required. When the victim is a logged-in administrator, the injected script runs with their session and can silently create a new admin user, change the admin e-mail and password, install a malicious plugin, or exfiltrate the authentication cookies. In a multi-author environment — magazines, agencies, membership sites — a single low-privileged Author account is enough to escalate to full control of the site.
Exploiting the Stored XSS Vulnerability
To reproduce the vulnerability on an unpatched site (< 4.7.19):
- Log in as a user with the Author role (or higher).
- Open the plugin panel Before and After Slider.
- Create a new slider.
- On the Content tab, upload any image into the Before Image field.
- On the Options tab, put the XSS payload into the After Label field.
- Copy the generated shortcode and paste it into any post or page.
PoC payload placed in the After Label field:
333"test=' onmouseover=alert(779) test=' //When the page containing the slider is opened and the mouse moves over the label, the injected onmouseover handler fires and alert(779) is executed in the context of the site. In a real attack the harmless alert() would be replaced by code that creates a rogue administrator or steals the session — and it would run automatically in the administrator’s browser the moment they preview or moderate the page.
Recommendations for Improved Security
To mitigate CVE-2025-15663:
- Update the BEAF plugin to version 4.7.19 or later immediately.
- Sanitize label fields on input and escape them on output with
esc_attr()/esc_html()so slider labels can never break out of their HTML context. - Restrict the
unfiltered_htmlcapability so that only trusted Administrators can submit raw HTML. - Review which roles really need access to slider creation; remove the capability from low-trust Author accounts where possible.
- Implement a strong Content Security Policy (CSP) to block inline JavaScript execution.
- Deploy a Web Application Firewall to filter XSS payloads before they reach the application.
To prevent this type of attack, follow our methods of XSS prevention.
By addressing Stored XSS vulnerabilities like CVE-2025-15663 early, WordPress site owners and plugin developers can protect administrators and visitors from account takeover. Stay vigilant, stay secure.
#WordPressSecurity #StoredXSS #BEAF #WebsiteSafety #StayProtected
Use CleanTalk solutions to improve the security of your website
Krugov Artyom
