.. / CVE-2021-24495

Exploit for Wordpress Marmoset Viewer <1.9.3 - Cross-Site Scripting (CVE-2021-24495)

Description:

WordPress Marmoset Viewer plugin before 1.9.3 contains a cross-site scripting vulnerability. It does not property sanitize, validate, or escape the ‘id’ parameter before outputting back in the page.

Nuclei Template

View the template here CVE-2021-24495.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2021/CVE-2021-24495.yaml
Copy

References:

https://johnjhacking.com/blog/cve-2021-24495-improper-neutralization-of-input-during-web-page-generation-on-id-parameter-in-wordpress-marmoset-viewer-plugin-versions-1.9.3-leads-to-reflected-cross-site-scripting/
https://wordpress.org/plugins/marmoset-viewer/#developers
https://wpscan.com/vulnerability/d11b79a3-f762-49ab-b7c8-3174624d7638
https://nvd.nist.gov/vuln/detail/CVE-2021-24495
https://github.com/ARPSyndicate/kenzer-templates