CVE-2025-15665 affects the Ultimate Before After Image Slider & Gallery (BEAF) plugin and is an authenticated Admin+ Stored Cross-Site Scripting vulnerability in versions below 4.7.1. The BEAF Slider widget stores its Enter Shortcode value and passes it to do_shortcode() without escaping non-shortcode content, so an administrator or another trusted widget manager can persist markup that executes in the browser of any visitor who loads a page containing the widget. If an administrator views the affected page, the script runs in that authenticated origin and can become an account takeover path. The issue is fixed in version 4.7.1.
| CVE | CVE-2025-15665 |
| Plugin Version | Ultimate Before After Image Slider & Gallery < 4.7.1, fixed in 4.7.1 |
| All Time | 1 140 856 |
| Active installations | 30 000+ |
| Publicly Published | June 23, 2026 |
| Last Updated | June 23, 2026 |
| Researcher | Dmitrii Ignatyev |
| CWE | CWE-79 |
| PoC | Yes |
| Exploit | No |
| Reference | https://www.cve.org/CVERecord?id=CVE-2025-15665 https://www.wordfence.com/threat-intel/vulnerabilities/id/2a42a360-9b85-4179-ba75-4eab06026b51?source=api-prod https://wpscan.com/vulnerability/754f0960-efc8-426f-bb1d-7cceec920910/ |
| Plugin Security Certification by CleanTalk |  |
| Logo of the plugin |  |
PSC by CleantalkJoin the community of developers who prioritize security. Highlight your plugin in the WordPress catalog.
Timeline
| May 19, 2025 | Plugin testing and vulnerability detection in BEAF were completed. |
| May 19, 2025 | The vulnerability was reported with PoC, description, and recommendations for remediation. |
| June 23, 2026 | CVE-2025-15665 was publicly published by WPScan. |
Discovery of the Vulnerability
The vulnerable flow is implemented in inc/widget/bafg-widget.php. The bafg_widget::form() method renders the Enter Shortcode field, while update() stores bafg_shortcode without sanitizing it. The field therefore accepts an HTML payload even when the site is configured to restrict unfiltered_html in ordinary post and comment editors.
On the front end, bafg_widget::widget() sends the stored value to do_shortcode( $instance['bafg_shortcode'] ). WordPress returns text that does not match a registered shortcode verbatim, and the widget echoes that return value inside its text container. Because the value is not escaped for HTML output, an element such as the supplied image tag reaches visitors and its event handler executes. The stored value persists in the widget configuration until it is removed or the plugin is updated.
Understanding of Stored Cross-Site Scripting attacks
Stored Cross-Site Scripting occurs when attacker-controlled content is saved and later rendered in a browser-executable context. In this case the payload is held in the BEAF widget configuration, not in the page body, so every page using that widget can deliver it. The browser treats the resulting event handler as page code when the image fails to load.
Widget management is normally restricted to administrators, but custom roles and multisite configurations can broaden access. A malicious value can execute when a visitor or an authenticated administrator opens a page that includes the widget. Code running in an administrator’s origin can abuse actions available to that session, which is why the issue can lead to account takeover even though the initial write requires privileged access.
Exploiting the Stored Cross-Site Scripting Vulnerability
On a site running BEAF below 4.7.1, an administrator or another account with permission to manage widgets can reproduce the issue with the following harmless payload. Ensure the widget is assigned to a visible widget area, then open a front-end page that displays that area.
POC:
POC: 1. Create a new widget named "BEAF Slider". 2. In the "Enter Shortcode" field, enter: <img src=x onerror=alert(1)> 3. Assign the widget to a visible widget area and open any page that displays it.____
The alert confirms that the shortcode field is rendered without output escaping. The value remains stored in the widget configuration and will execute again for users who load pages that include the widget until it is removed or the plugin is patched.
Recommendations for Improved Security
Site owners should update BEAF to version 4.7.1 or later. Until the update is applied, remove suspicious BEAF Slider widgets, restrict widget management to trusted administrators, and review pages and widget areas that may contain older configurations. A restrictive Content Security Policy can reduce impact but does not replace the plugin update.
Developers should avoid passing arbitrary widget text directly to do_shortcode(). If custom shortcode input must remain supported, allowlist the expected shortcode tags, sanitize the stored value, and escape any non-shortcode output for its final HTML context. Security checks should also be applied when the widget is rendered, not only when its settings are saved.
By addressing Stored Cross-Site Scripting issues like CVE-2025-15665, WordPress site owners can prevent privileged widget settings from becoming a persistent browser-side execution path. Stay vigilant, stay secure.
#WordPressSecurity #StoredXSS #BEAF #WidgetSecurity #WebsiteSafety #StayProtected #LowVulnerability
Use CleanTalk solutions to improve the security of your website
