{"id":"CVE-2025-15665","aliases":["EUVD-2025-210458","GHSA-h7cp-867p-67hq"],"status":"published","title":"BEAF \u003c 4.7.1 - Admin+ Stored XSS via Widget Shortcode Field","description":"The Ultimate Before After Image Slider \u0026 Gallery  WordPress plugin before 4.7.1 does not escape the value of the BEAF Slider widget's shortcode field before outputting it on the front end (the value is passed through do_shortcode, which echoes non-shortcode content verbatim), allowing users with administrator-level access to store a script that executes in the browser of any visitor who loads a page displaying the widget.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00226,"percentile":0.13384,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2026-07-14T06:00:01Z","modified":"2026-09-29T15:10:00Z","products":[{"vendor":"unknown","product":"ultimate before after image slider \u0026 gallery"}],"references":[{"url":"https://wpscan.com/vulnerability/754f0960-efc8-426f-bb1d-7cceec920910/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15665"},{"url":"https://wpscan.com/vulnerability/754f0960-efc8-426f-bb1d-7cceec920910"},{"url":"https://github.com/advisories/GHSA-h7cp-867p-67hq"}],"sources":{"cve":[{"id":"CVE-2025-15665","title":"BEAF \u003c 4.7.1 - Admin+ Stored XSS via Widget Shortcode Field","description":"The Ultimate Before After Image Slider \u0026 Gallery  WordPress plugin before 4.7.1 does not escape the value of the BEAF Slider widget's shortcode field before outputting it on the front end (the value is passed through do_shortcode, which echoes non-shortcode content verbatim), allowing users with administrator-level access to store a script that executes in the browser of any visitor who loads a page displaying the widget.","status":"published","published":"2026-07-14T06:00:01.908Z","modified":"2026-07-14T12:47:58.589Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:32:37.680845Z"}],"euvd":[{"id":"EUVD-2025-210458","description":"The Ultimate Before After Image Slider \u0026 Gallery  WordPress plugin before 4.7.1 does not escape the value of the BEAF Slider widget's shortcode field before outputting it on the front end (the value is passed through do_shortcode, which echoes non-shortcode content verbatim), allowing users with administrator-level access to store a script that executes in the browser of any visitor who loads a page displaying the widget.","status":"published","published":"2026-07-14T06:00:01Z","modified":"2026-07-14T12:47:58Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:00.206712Z"}],"ghsa":[{"id":"GHSA-h7cp-867p-67hq","title":"The Ultimate Before After Image Slider \u0026 Gallery  WordPress plugin before 4.7.1 does not escape...","description":"The Ultimate Before After Image Slider \u0026 Gallery  WordPress plugin before 4.7.1 does not escape the value of the BEAF Slider widget's shortcode field before outputting it on the front end (the value is passed through do_shortcode, which echoes non-shortcode content verbatim), allowing users with administrator-level access to store a script that executes in the browser of any visitor who loads a page displaying the widget.","status":"published","published":"2026-07-14T06:31:22Z","modified":"2026-07-14T15:32:14Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:09:27.031Z"}],"nvd":[{"id":"CVE-2025-15665","description":"The Ultimate Before After Image Slider \u0026 Gallery  WordPress plugin before 4.7.1 does not escape the value of the BEAF Slider widget's shortcode field before outputting it on the front end (the value is passed through do_shortcode, which echoes non-shortcode content verbatim), allowing users with administrator-level access to store a script that executes in the browser of any visitor who loads a page displaying the widget.","status":"published","published":"2026-07-14T06:16:41.087Z","modified":"2026-09-29T15:10:00.193Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"updated_at":"2026-11-02T14:12:02.535029Z"}]}}