	public function before_content( $content ) {

		global $post;
		$post_id = $post->ID;

		// show on single sell media pages
		if ( is_singular( 'sell_media_item' ) || sell_media_attachment( $post_id ) || sell_media_is_search() ) {

			// bail if it's password protected item
			if ( post_password_required( $post ) || ( isset( $post->post_parent ) && post_password_required( $post->post_parent ) ) ) {
				return $content;
			}

			$has_multiple_attachments = sell_media_has_multiple_attachments( $post_id );
			$wrap = ( ! $has_multiple_attachments || 'attachment' === get_post_type( $post_id ) ) ? true : false;
			$new_content = '';

			// only wrap content if a single image/media is being viewed
			if ( $wrap ) {
				$new_content .= '<div class="sell-media-content">';
			}

			$new_content .= sell_media_breadcrumbs();
			$new_content .= sell_media_get_media();
			$new_content .= $content;

			// only wrap content if a single image/media is being viewed
			if ( $wrap ) {
				$new_content .= '</div>';
			}

			$content = $new_content;

			// set the post views, used for popular query
			sell_media_set_post_views( $post_id );
		}

		return apply_filters( 'sell_media_content', $content );

	}
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.