Description
This script is possibly vulnerable to client side template injection attacks.
Client side template injection is a vulnerability similar to cross site scripting that allows an attacker to send malicious code (usually in the form of JavaScript) to another user.
The injected code is executed by the client side templating and allows the attacker to take control of the victim's browser.
Remediation
Apply context-dependent encoding and/or validation to user input rendered on a page
References
Related Vulnerabilities
WordPress Plugin WP Google Fonts Cross-Site Scripting (3.1.3)
WordPress Plugin Yoast SEO Cross-Site Scripting (5.7.1)
WordPress Plugin yolink Search for WordPress Cross-Site Scripting (2.5)
Drupal Core 4.6.x Cross-Site Scripting (4.6.0 - 4.6.8)
WordPress Plugin EELV Newsletter Cross-Site Scripting (3.3.0)