CVE-2021-24495

MEDIUM NUCLEI

Marmoset Viewer < 1.9.3 - Reflected Cross-Site Scripting via ID Parameter

Title source: llm

Exploitation Summary

CVE-2021-24495 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

The Marmoset Viewer WordPress plugin before 1.9.3 does not property sanitize, validate or escape the 'id' parameter before outputting back in the page, leading to a reflected Cross-Site Scripting issue.

Nuclei Templates (1)

Wordpress Marmoset Viewer <1.9.3 - Cross-Site Scripting

MEDIUMby johnjhacking

References (2)

Core 2

Core References

Exploit, Third Party Advisory x_refsource_misc

https://wpscan.com/vulnerability/d11b79a3-f762-49ab-b7c8-3174624d7638

Exploit, Third Party Advisory x_refsource_misc

https://johnjhacking.com/blog/cve-2021-24495-improper-neutralization-of-input-during-web-page-generation-on-id-parameter-in-wordpress-marmoset-viewer-plugin-versions-1.9.3-leads-to-reflected-cross-site-scripting/

Scores

CVSS v3 6.1

EPSS 0.0290

EPSS Percentile 85.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (1)

marmoset/marmoset_viewer < 1.9.3

Published Aug 09, 2021

Tracked Since Feb 18, 2026