Description

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's before-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser of anyone (including an administrator) who views the slider.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-09-02T06:17:15.700Z",
  "pubdate": "2026-09-02T06:17:15.700Z",
  "executiveSummary": "The Ultimate Before After Image Slider & Gallery WordPress plugin, specifically versions prior to 4.7.19, contains a Stored Cross-Site Scripting (XSS) vulnerability. This flaw exists due to the improper sanitization of the before-label input field during the plugin configuration process.\nThe vulnerability allows authenticated users with Author permissions or higher to inject malicious JavaScript payloads into the plugin settings. These payloads are stored in the database and subsequently executed within the context of any user session that renders the affected slider, including high-privileged administrator accounts.\nThe impact of this vulnerability is significant, as successful exploitation enables an attacker to perform unauthorized actions on behalf of the victim, potentially leading to full site compromise, account takeover, or the exfiltration of sensitive session data. Because the payload executes client-side upon rendering the slider, no interaction other than viewing the page containing the slider is required for the attack to trigger. Immediate updates are recommended to mitigate this risk, as the current exploitation requirement of Author-level access is commonly met in multi-user WordPress environments.",
  "technicalDetails": "The vulnerability resides in the handling of the 'before-label' field within the plugin's administrative settings interface. The root cause is the lack of proper output encoding or sanitization when the plugin saves the slider configuration, combined with an insecure DOM-based re-injection pattern performed by the bundled client-side JavaScript.\nDuring the plugin's operational flow, the value provided in the 'before-label' input is persisted directly into the WordPress database. When the front-end components of the plugin are initialized, a client-side script retrieves this stored value and dynamically injects it into the Document Object Model (DOM) to label the image slider interface. Because the plugin fails to sanitize the input before storage or escape the output during the re-injection process, it effectively treats user-supplied data as executable HTML or script content.\nAn attacker with Author-level privileges can navigate to the plugin settings and input a crafted JavaScript payload (e.g., <img src=x onerror=alert(document.cookie)>) into the 'before-label' field. Upon saving, the malicious payload is stored server-side. When an administrator or another user views a page or post where the specific slider instance is displayed, the plugin's client-side script executes the embedded payload within the context of the victim's browser session.\nThis behavior facilitates a classic Stored XSS attack vector, bypassing standard client-side protections because the injected script originates from the legitimate site domain. The post-exploitation impact includes, but is not limited to, the execution of arbitrary JavaScript to bypass CSRF protections, perform administrative actions (such as creating new users or modifying plugin configurations), or redirecting users to malicious external domains. The vulnerability persists across all slider instances utilizing the compromised configuration until the malicious string is sanitized or removed from the database.\nAffected versions include all releases of The Ultimate Before After Image Slider & Gallery plugin prior to 4.7.19. The attack flow is deterministic and requires no specialized network conditions, operating entirely through the application's standard administrative interface and the subsequent rendering of the front-end components."
}