Description
The src parameter for one script tag from this page is dirrectly controlled by user input. An attacker who can control the reference location to a JavaScript source file can load a script of their choice into an application.
Remediation
Your script should properly sanitize user input. Do not allow user-input to control script source location references.
References
OWASP - Cross Site Scripting (XSS)
CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Related Vulnerabilities
WordPress Plugin YARPP-Yet Another Related Posts Cross-Site Scripting (5.30.2)
WordPress Plugin Users Ultra Membership Cross-Site Scripting (1.5.78)
WordPress Plugin Soundy Background Music Cross-Site Scripting (3.1)
WordPress Plugin OAuth Single Sign On-SSO (OAuth Client) Cross-Site Scripting (6.20.2)
WordPress Plugin Stripe Payment for WooCommerce Cross-Site Scripting (3.5.9)