CVE-2025-15664 Ultimate Before After Image Slider & Gallery CVE debrief

Who should care

Defenders who manage WordPress sites with the Ultimate Before After Image Slider & Gallery plugin should assess their exposure and prioritize verification of the plugin version and monitoring for suspicious activity.

Why it matters

The Ultimate Before After Image Slider & Gallery WordPress plugin vulnerability allows users with the Author role and above to store a payload that executes in the browser of anyone who views the slider, potentially leading to cross-site scripting attacks. Defenders should prioritize verification of the plugin version and monitoring for suspicious activity.

• Defenders need to verify the plugin version to prevent exploitation.
• Defenders should monitor for suspicious activity to detect potential attacks.
• Defenders may need to implement additional security measures such as Content Security Policy (CSP) to mitigate the vulnerability.

Technical summary

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's before-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser of anyone (including an administrator) who views the slider. This vulnerability has a CVSS score of 6.8 and a severity of MEDIUM.

Defensive priority

Defenders should prioritize verifying the version of the Ultimate Before After Image Slider & Gallery WordPress plugin and ensuring that it is updated to 4.7.19 or later. Additionally, defenders should monitor for suspicious activity on their WordPress sites, particularly for users with the Author role and above.

Recommended defensive actions

• Verify the version of the Ultimate Before After Image Slider & Gallery WordPress plugin and ensure that it is updated to 4.7.19 or later.
• Monitor for suspicious activity on WordPress sites, particularly for users with the Author role and above.
• Restrict the Author role and above to only those who need it, and consider implementing additional security measures such as Content Security Policy (CSP).
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE Program record and NVD vulnerability detail page provide information about the vulnerability, including its description and CVSS score. A source reference from WPScan provides additional context.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.