CVE-2019-6112

MEDIUMNuclei

WordPress Sell Media 2.4.1 - Cross-Site Scripting

Title source: github.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2019-6112 has a selected CVSS score of 6.1 (medium); EIP currently links 1 curated repository PoC and 1 Nuclei template.

Description

A Cross-site scripting (XSS) vulnerability in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the keyword parameter (aka $search_term or the Search field).

Description source: CVE List

Exploitation context

Available material

Curated repository PoCs
1
Nuclei templates
1

Proofs of concept

1

Curated repository PoCs

GitHubCVE-2019-6112Curated repository PoCby yubsy112Not analyzed1 file

Python · 438 B

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Sell Media 2.4.1 - Cross-Site ScriptingCVSS 6.1

WordPress Plugin Sell Media v2.4.1 contains a cross-site scripting vulnerability in /inc/class-search.php that allows remote attackers to inject arbitrary web script or HTML via the keyword parameter (aka $search_term or the Search field).

Impact

Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of a victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Update to the latest version of WordPress Sell Media or apply the vendor-provided patch to mitigate this vulnerability.

WeaknessesCWE-79
Authorsdwisiswant0
Template tagscvecve2019wordpresswp-pluginxssgraphpaperpressvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:graphpaperpress:sell_media:*:*:*:*:*:wordpress:*:*
https://github.com/graphpaperpress/Sell-Media/commit/8ac8cebf332e0885863d0a25e16b4b180abedc47#diff-f16fea0a0c8cc36031ec339d02a4fb3b https://nvd.nist.gov/vuln/detail/CVE-2019-6112 https://metamorfosec.com/Files/Advisories/METS-2020-001-A_XSS_Vulnerability_in_Sell_Media_Plugin_v2.4.1_for_WordPress.txt https://github.com/ARPSyndicate/kenzer-templates https://github.com/Elsfa7-110/kenzer-templates

Source: ProjectDiscovery

References

3