CVE-2025-47549

Ultimate Before After Image Slider & Gallery – BEAF 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo validlft forever preferredlft forever inet6 ::1/128 scope host validlft forever preferredlf...

CVE-2025-15664 BEAF < 4.7.19 - Author+ Stored XSS via Before Label

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's before-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser ...

CVE-2025-15664

The Ultimate Before After Image Slider & Gallery WordPress plugin (versions before 4.7.19 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to properly escape the slider's before-label value before a bundled client-side script re-injects it into the DOM. T...

CVE-2025-15664 BEAF < 4.7.19 - Author+ Stored XSS via Before Label

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's before-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser ...

WordPress Ultimate Before After Image Slider & Gallery plugin < 4.7.19 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin BEAF versions 4.7.19...

CVE-2025-15663 BEAF < 4.7.19 - Author+ Stored XSS via After Label

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's after-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser o...

CVE-2025-15663 BEAF < 4.7.19 - Author+ Stored XSS via After Label

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's after-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser o...

CVE-2025-15663

The Ultimate Before After Image Slider & Gallery WordPress plugin (BEAF), in versions before 4.7.19 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to properly escape the slider's after-label value before a bundled client-side script re-injects it into t...

WordPress Ultimate Before After Image Slider & Gallery plugin < 4.7.19 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin BEAF versions 4.7.19...

EUVD-2025-210458

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.1 does not escape the value of the BEAF Slider widget's shortcode field before outputting it on the front end the value is passed through doshortcode, which echoes non-shortcode content verbatim, allowing users with...

CVE-2025-15665 BEAF < 4.7.1 - Admin+ Stored XSS via Widget Shortcode Field

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.1 does not escape the value of the BEAF Slider widget's shortcode field before outputting it on the front end the value is passed through doshortcode, which echoes non-shortcode content verbatim, allowing users with...

CVE-2025-15665

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.1 does not escape the value of the BEAF Slider widget's shortcode field before outputting it on the front end the value is passed through doshortcode, which echoes non-shortcode content verbatim, allowing users with...

CVE-2025-15665

The Ultimate Before After Image Slider & Gallery WordPress plugin, versions before 4.7.1 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The issue arises because the plugin fails to escape the value of the BEAF Slider widget's shortcode field before outputting it on the front end; sp...

CVE-2025-15665: Undefined Security Weakness

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.1 does not escape the value of the BEAF Slider widget's shortcode field before outputting it on the front end the value is passed through doshortcode, which echoes non-shortcode content verbatim, allowing users with...

PT-2026-57962

Name of the Vulnerable Software and Affected Versions The Ultimate Before After Image Slider & Gallery versions prior to 4.7.1 Description Insufficient input sanitization and output escaping in the BEAF Slider widget's shortcode field allow users with administrator-level access to perform Stored...

EUVD-2024-30251

Malicious code in bioql PyPI...

EUVD-2025-30765

Malicious code in bioql PyPI...

EUVD-2025-13787

Malicious code in bioql PyPI...

CVE-2025-53461

Server-Side Request Forgery SSRF vulnerability in Binsaifullah Beaf image-compare-block allows Server Side Request Forgery.This issue affects Beaf: from n/a through = 1.6.2...

WordPress Beaf Plugin <= 1.6.2 - Server Side Request Forgery (SSRF) Vulnerability

Server Side Request Forgery SSRF Vulnerability discovered by Nabil Irawan in WordPress Plugin Beaf versions = 1.6.2...