Beaf Before And After Gallery Vulnerabilities

The BEAF plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will...

CVSS:

4.4

Affected:

up to 4.7.0

Fixed in:

4.7.1

Disclosed:

Jun 23, 2026

CVE-2025-15665 on NVD →

The Ultimate Before After Image Slider & Gallery – BEAF plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 4.6.10. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files...

CVSS:

7.2

Affected:

up to 4.6.10

Fixed in:

4.6.11

Disclosed:

May 7, 2025

CVE-2025-47549 on NVD →

The BEAF plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.4. This is due to missing or incorrect nonce validation on the bafg_new_feature_notice_dismissed() function. This makes it possible for unauthenticated attackers to dismiss notices via a forged request grante...

CVSS:

4.3

Affected:

up to 4.5.4

Fixed in:

4.5.5

Disclosed:

Apr 12, 2024

CVE-2024-32433 on NVD →