Description

The src parameter for one script tag from this page is dirrectly controlled by user input. An attacker who can control the reference location to a JavaScript source file can load a script of their choice into an application.

Remediation

Your script should properly sanitize user input. Do not allow user-input to control script source location references.

References

OWASP - Cross Site Scripting (XSS)

CWE-829: Inclusion of Functionality from Untrusted Control Sphere

Related Vulnerabilities

WordPress Plugin Email Encoder-Protect Email Addresses Multiple Cross-Site Scripting Vulnerabilities (1.4.3)

WordPress Plugin WP Super Cache Cross-Site Scripting (1.7.2)

WordPress Plugin Blunt GA Cross-Site Scripting (4.0.0)

WordPress Plugin SVG Support Cross-Site Scripting (2.3.19)

WordPress Plugin WordPress Form Customizer-CF7 Customizer Cross-Site Scripting (1.6.1)

Severity

High

Classification

CWE-79 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N

Tags

XSS