Threat Entry Updated 2025-01-07

CVE-2024-11777 - Sell Media Plugin

The Sell Media plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sell_media_search_form_gutenberg' shortcode in all versions up to, and including, 2.5.8.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Sell Media

CVE-2024-11777

MEDIUM CVSS 6.4 2025-01-07

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-04-08

CVE-2021-4420 - Sell Media Plugin

The Sell Media plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.5. This is due to missing or incorrect nonce validation on the sell_media_process() function. This makes it possible for unauthenticated attackers to sell media paypal orders via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

PLUGIN Sell Media

CVE-2021-4420

MEDIUM CVSS 4.3 2023-07-12

Risk Score

Open Full Technical Breakdown