Executive brief
The Ultimate Before After Image Slider & Gallery WordPress plugin allows users with Author role or above to inject malicious JavaScript into slider labels. When other users—including administrators—view a published post containing the affected slider, the attacker's code executes in their browser, potentially compromising their accounts or stealing sensitive data. This vulnerability requires an authenticated attacker but can impact any user who views the slider.
Technical details
This is a stored cross-site scripting (XSS) vulnerability caused by improper escaping of the before-label attribute value. The plugin stores user input in the before-label field and later re-injects it into the DOM via a client-side script without sanitization. An attacker with Author role or higher can craft a label value containing JavaScript (e.g., "Before' onmouseover='alert(document.domain)' x='") that breaks out of the single-quoted attribute and becomes a live event handler. When the plugin concatenates the unescaped value into markup and injects it, the browser interprets the attacker's event handler. The vulnerability requires the slider's "Show Overlay" option to be enabled (which is the default), and executes when any user views a post embedding the affected slider. This issue is fixed in version 4.7.19.
Affected products
- Solodkiy Ultimate Before After Image Slider & Gallery before 4.7.19
Timeline
- 2026-08-31: disclosed
- 2026-08-31: patched: Fixed in version 4.7.19