7 matches found
CVE-2025-15664
The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 is vulnerable to a stored XSS via the slider's before-label value. The plugin does not properly escape this value before its bundled client-side script re-injects it into the DOM. An attacker with the Author role or h...
EUVD-2025-210822
The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's before-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser ...
CVE-2025-9030
The Majestic Before After Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'beforelabel' and 'afterlabel' parameters in versions less than, or equal to, 2.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
EUVD-2025-32418
The Majestic Before After Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'beforelabel' and 'afterlabel' parameters in versions less than, or equal to, 2.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
CVE-2025-9030 Majestic Before After Image <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Majestic Before After Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'beforelabel' and 'afterlabel' parameters in versions less than, or equal to, 2.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
CVE-2025-9030 Majestic Before After Image <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Majestic Before After Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'beforelabel' and 'afterlabel' parameters in versions less than, or equal to, 2.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...