CVE-2021-24495

6.1 mediumEPSS 3.3%

Medium (6.1) in marmoset marmoset viewer. EPSS 3.3% chance of exploitation in the next 30 days.

The Marmoset Viewer WordPress plugin before 1.9.3 does not property sanitize, validate or escape the 'id' parameter before outputting back in the page, leading to a reflected Cross-Site Scripting issue.

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 3.3% chance of exploitation in the next 30 days; higher than 88% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2021-08-09
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

marmoset:marmoset_viewer

References

https://johnjhacking.com/blog/cve-2021-24495-improper-neutralization-of-input-during-web-page-generation-on-id-parameter-in-wordpress-marmoset-viewer-plugin-versions-1.9.3-leads-to-reflected-cross-site-scripting/
https://wpscan.com/vulnerability/d11b79a3-f762-49ab-b7c8-3174624d7638
https://johnjhacking.com/blog/cve-2021-24495-improper-neutralization-of-input-during-web-page-generation-on-id-parameter-in-wordpress-marmoset-viewer-plugin-versions-1.9.3-leads-to-reflected-cross-site-scripting/
https://wpscan.com/vulnerability/d11b79a3-f762-49ab-b7c8-3174624d7638

Check your stack JSON