Sell Media <= 2.5.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
medium
The Sell Media plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sell_media_search_form_gutenberg' shortcode in all versions up to, and including, 2.5.8.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated at...
- CVSS:
- 6.4
- Affected:
- up to 2.5.8.5
- Fix:
- No patched version reported
- Disclosed:
- Jan 6, 2025
CVE-2024-11777 on NVD →
Sell Media <= 2.5.5 - Cross-Site Request Forgery Bypass
medium
The Sell Media plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.5. This is due to missing or incorrect nonce validation on the sell_media_process() function. This makes it possible for unauthenticated attackers to sell media paypal orders via a forged request grante...
- CVSS:
- 4.3
- Affected:
- up to 2.5.5
- Fixed in:
- 2.5.6
- Disclosed:
- Aug 16, 2021
CVE-2021-4420 on NVD →
Sell Media <= 2.4.1 - Cross-Site Scripting
medium
A Cross-site scripting (XSS) vulnerability in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the keyword parameter (aka $search_term or the Search field).
- CVSS:
- 6.1
- Affected:
- up to 2.4.2
- Fixed in:
- 2.4.2
- Disclosed:
- Aug 12, 2020
CVE-2019-6112 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database