CVE-2021-24495: Marmoset Viewer

Medium severity, CVSS 6.1. EPSS: 3.3% chance of exploitation in the next 30 days.

The Marmoset Viewer WordPress plugin before 1.9.3 does not property sanitize, validate or escape the 'id' parameter before outputting back in the page, leading to a reflected Cross-Site Scripting issue.

Affected products

• Marmoset Marmoset Viewer: before 1.9.3 (fixed in 1.9.3)

Published 2021-08-09. Last modified 2026-06-17.