The Marmoset Viewer WordPress plugin before 1.9.3 does not property sanitize, validate or escape the 'id' parameter before outputting back in the page, leading to a reflected Cross-Site Scripting issue.
CVSS 3.1MEDIUM 6.1·Network·No auth·User interaction·EPSS 0.03343·Published 2021-08-09·Fixed in 1.9.3CWE-79