漏洞描述
WordPress Marmoset Viewer plugin before 1.9.3 contains a cross-site scripting vulnerability. It does not property sanitize, validate, or escape the 'id' parameter before outputting back in the page.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
johnjhacking.comhttps://johnjhacking.com/blog/cve-2021-24495-improper-neutralization-of-input-during-web-page-generation-on-id-parameter-in-wordpress-marmoset-viewer-plugin-versions-1.9.3-leads-to-reflected-cross-site-scripting/↗wordpress.orghttps://wordpress.org/plugins/marmoset-viewer/#developers↗wpscan.comhttps://wpscan.com/vulnerability/d11b79a3-f762-49ab-b7c8-3174624d7638↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2021-24495↗github.comhttps://github.com/ARPSyndicate/kenzer-templates↗