PT-2020-11192 · WordPress · Sell Media Plugin

Published 2020-08-14 · Updated 2020-08-19 · CVE-2019-6112

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sell Media plugin version 2.4.1 for WordPress

Description A Cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the keyword parameter (also known as $search term or the Search field) in the /inc/class-search.php file. This enables attackers to execute malicious scripts on the client-side.

Recommendations For Sell Media plugin version 2.4.1, consider disabling the search functionality in /inc/class-search.php until a patch is available, or avoid using the keyword parameter in the affected API endpoint to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-6112

Affected Products

Sell Media Plugin

References · 5

• https://github.com/graphpaperpress/Sell-Media/commit/8ac8cebf332e0885863d0a25e16b4b180abedc47#diff-f16fea0a0c8cc36031ec339d02a4fb3b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-6112 · Security Note
• https://osv.dev/vulnerability/CVE-2019-6112 · Vendor Advisory
• https://metamorfosec.com/Files/Advisories/METS-2020-001-A_XSS_Vulnerability_in_Sell_Media_Plugin_v2.4.1_for_WordPress.txt · Note
• https://t.me/cibsecurity/14142 · Telegram Post