WordPress Plugin Vulnerabilities

BEAF < 4.7.19 - Author+ Stored XSS via After Label

Description

The plugin does not properly escape the slider's after-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser of anyone (including an administrator) who views the slider.

Proof of Concept

Affects Plugins

Plugin icon
beaf-before-and-after-gallery
Fixed in 4.7.19

References

CVE
CVE-2025-15663

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Krugov Artyom
Submitter
Krugov Aryom
Submitter website
https://research.cleantalk.org
Verified
Yes
WPVDB ID
56dd063a-c097-4fed-83bc-99799b4a229d

Timeline

Publicly Published
2026-08-31 (about 1 day ago)
Added
2026-08-31 (about 19 hours ago)
Last Updated
2026-08-31 (about 19 hours ago)

Other

Published
Title
Published
2026-04-28
Title
WP Meteor Website Speed Optimization Addon < 3.4.17 - Unauthenticated Stored Cross-Site Scripting via Comment
Published
2025-01-06
Title
SpeakOut! Email Petitions < 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-03-29
Title
WP Twitter Mega Fan Box Widget <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2024-11-22
Title
JobBoardWP – Job Board Listings and Submissions < 1.3.1 - Reflected Cross-Site Scripting
Published
2024-10-25
Title
Poll Maker – Versus Polls, Anonymous Polls, Image Polls < 5.4.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Poll Settings