Executive brief
The Ultimate Before After Image Slider & Gallery WordPress plugin allows users with Author-level access and above to inject malicious code into the "after-label" field of image sliders. When any visitor (including administrators) views a page containing the slider, the malicious code executes in their browser, potentially allowing attackers to steal credentials, modify content, or perform actions on behalf of the victim.
Technical details
This is a stored cross-site scripting (XSS) vulnerability caused by improper escaping of the slider's after-label value before client-side JavaScript re-injects it into the DOM. An authenticated user with Author role or above can craft a malicious label string (e.g., "After' onclick='alert(document.domain)' x='") that breaks out of the single-quoted data-content attribute, allowing arbitrary HTML attributes and event handlers to be injected. When the "Show Overlay" option is enabled (the default), the vulnerable markup is rendered and the injected JavaScript executes in the context of any user viewing the slider, including administrators. The vulnerability has been fixed in version 4.7.19.
Affected products
- BeAF Before After Gallery before 4.7.19
Timeline
- 2026-08-31: disclosed
- 2026: patched: Fixed in version 4.7.19