CyberRota Analysis
AI-GeneratedThe Ultimate Before After Image Slider & Gallery plugin for WordPress versions prior to 4.7.1 is vulnerable due to inadequate escaping of the shortcode field in the BEAF Slider widget, allowing administrators to inject malicious scripts. This vulnerability can lead to cross-site scripting (XSS) attacks, impacting any visitor who views the affected page. WordPress site administrators should prioritize updating this plugin to mitigate potential exploitation risks.
Original NVD Description
The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.1 does not escape the value of the BEAF Slider widget's shortcode field before outputting it on the front end (the value is passed through do_shortcode, which echoes non-shortcode content verbatim), allowing users with administrator-level access to store a script that executes in the browser of any visitor who loads a page displaying the widget.