Executive brief
A vulnerability in the Ultimate Before After Image Slider & Gallery plugin for WordPress allows users with administrative privileges to inject malicious scripts into image slider widgets. These scripts execute automatically in the browsers of any visitor who views a page containing the affected slider. This could lead to unauthorized actions being performed on behalf of visitors or the theft of sensitive session information.
Technical details
The Ultimate Before After Image Slider & Gallery (BEAF) plugin fails to properly sanitize or escape the 'shortcode' field within its BEAF Slider widget. The input is passed directly to the WordPress 'do_shortcode' function, which outputs non-shortcode content verbatim to the front end. An attacker with administrator-level access can exploit this to store malicious JavaScript (Stored XSS). The script executes when any user, including other administrators or site visitors, views the page where the widget is deployed. The issue is resolved in version 4.7.1.
Affected products
- Unknown Ultimate Before After Image Slider & Gallery (BEAF) < 4.7.1
Timeline
- 2026-06-23: disclosed
- 2026-06-23: advisory
- 2026-07-14: other: NVD publication date