Description

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's after-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser of anyone (including an administrator) who views the slider.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-09-02T06:17:14.587Z",
  "pubdate": "2026-09-02T06:17:14.587Z",
  "executiveSummary": "The Ultimate Before After Image Slider & Gallery WordPress plugin, in versions prior to 4.7.19, contains a stored Cross-Site Scripting (XSS) vulnerability. The flaw resides in the handling of the 'after-label' parameter, which fails to undergo proper sanitization or output encoding before being processed by the plugin's client-side scripting.\nAn authenticated user with Author-level privileges or higher can inject malicious JavaScript payloads into the slider configuration. When a victim, such as an administrator, views a page containing the affected slider, the injected script executes within the context of the user's browser session.\nThis vulnerability poses a significant security risk, as it allows attackers to hijack administrator sessions, perform unauthorized administrative actions, redirect users, or exfiltrate sensitive data stored within the browser's local storage or session cookies. The exploitation does not require advanced network access, relying instead on the attacker's ability to create or modify gallery content within the WordPress environment.\nThe primary impact is the compromise of user integrity and confidentiality, potentially leading to a full site compromise if administrative privileges are obtained through session hijacking.",
  "technicalDetails": "The root cause of this vulnerability is improper neutralization of input within the 'after-label' field of the Ultimate Before After Image Slider & Gallery plugin. The plugin accepts user-supplied input for the slider labels, which is saved to the database without adequate validation or sanitization. Subsequently, the plugin's client-side JavaScript reads this value from the DOM or an API response and dynamically re-injects it into the Document Object Model (DOM) using unsafe methods.\nExploitation is achieved by an attacker with at least Author-level access who navigates to the plugin settings where the 'after-label' property can be defined. By inputting a crafted payload—such as '<img src=x onerror=alert(document.cookie)>'—the attacker persists the malicious script in the WordPress database.\nThe attack flow follows these steps: 1) The authenticated attacker submits a malicious payload via the 'after-label' field in the plugin's slider configuration interface. 2) The server stores this payload in the database without performing server-side output encoding or input sanitization. 3) A legitimate user, such as an administrator, navigates to a post or page where the slider is embedded. 4) The plugin's bundled client-side script fetches the stored data and injects the raw, malicious string into the page's HTML structure. 5) The browser interprets the injected string as an executable script, triggering the payload within the context of the administrator's authenticated session.\nBecause the payload executes in the context of the victim's browser, the attacker inherits the victim's session tokens. This enables the execution of unauthorized actions, such as creating new administrative users, modifying plugin settings, or injecting further malicious content into the WordPress database. This stored XSS attack is persistent, meaning every subsequent view of the slider by any user will trigger the malicious script. The vulnerability affects all versions of the Ultimate Before After Image Slider & Gallery plugin prior to 4.7.19 and is mitigated by upgrading to the patched release, which implements proper output encoding for the affected slider properties."
}