What is GHSA-h7cp-867p-67hq?

GHSA-h7cp-867p-67hq is a security advisory published by GitHub Security Advisories with Medium severity. The Ultimate Before After Image Slider \u0026 Gallery WordPress plugin before 4.7.1 does not escape...

Which CVE IDs does GHSA-h7cp-867p-67hq cover?

GHSA-h7cp-867p-67hq covers the following CVE IDs: CVE-2025-15665. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-h7cp-867p-67hq?

GHSA-h7cp-867p-67hq has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

GHSA-h7cp-867p-67hqMediumCVSS 5.4

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.1 does not escape...

Vendor

GitHub Security Advisories

Published

July 14, 2026

Last Modified

July 14, 2026

🔗 CVE IDs covered (1)

CVE-2025-15665 →

📋 Description

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.1 does not escape the value of the BEAF Slider widget's shortcode field before outputting it on the front end (the value is passed through do_shortcode, which echoes non-shortcode content verbatim), allowing users with administrator-level access to store a script that executes in the browser of any visitor who loads a page displaying the widget.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2025-15665
https://wpscan.com/vulnerability/754f0960-efc8-426f-bb1d-7cceec920910
https://github.com/advisories/GHSA-h7cp-867p-67hq