Description
The character encoding (charset) of this page is dirrectly controlled by user input. The charset can be specified in the Content-Type header or in a meta tag declaration. If an attacker can control the response charset, they could manipulate the HTML to perform XSS or other attacks.
Remediation
It's recommended to force UTF-8 in charset declarations. If the user must control the charset, make sure you are using a whitelist of accepted charsets.
References
Related Vulnerabilities
WordPress Plugin Infusionsoft Gravity Forms Add-on Cross-Site Scripting (1.5.11)
WordPress Plugin Gravity Forms FreshDesk Cross-Site Scripting (1.2.8)
WordPress Plugin Business Card Cross-Site Scripting (1.0.0)
Drupal Core 8.x.x Cross-Site Scripting (8.0.0 - 8.8.12)
WordPress Plugin Admin Bar User Switching Cross-Site Scripting (1.0.4)