Description

An attacker can control one or more parameter values of a sensitive HTML tag (e.g. link href). In some conditions this can cause security issues such as XSS (cross-site scripting).

Remediation

Your script should properly sanitize user input. Do not allow user-input to fully control important parameter tag values.

References

OWASP - Cross Site Scripting (XSS)

CWE-829: Inclusion of Functionality from Untrusted Control Sphere

Related Vulnerabilities

WordPress Plugin Photospace Gallery Cross-Site Scripting (2.3.5)

WordPress Plugin Relevanssi-A Better Search Cross-Site Scripting (4.0.4)

WordPress Plugin JobSearch WP Job Board Cross-Site Scripting (1.5.4)

WordPress Plugin Appointment Booking Calendar Cross-Site Scripting (1.3.34)

WordPress Plugin wpForo Forum Cross-Site Scripting (2.1.8)

Severity

Medium

Classification

CWE-79 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N

Tags

XSS