Description
The character encoding (charset) of this page is dirrectly controlled by user input. The charset can be specified in the Content-Type header or in a meta tag declaration. If an attacker can control the response charset, they could manipulate the HTML to perform XSS or other attacks.
Remediation
It's recommended to force UTF-8 in charset declarations. If the user must control the charset, make sure you are using a whitelist of accepted charsets.
References
Related Vulnerabilities
Joomla! Core 2.5.x Cross-Site Scripting (2.5.0 - 2.5.6)
WordPress Plugin Awesome Support-WordPress HelpDesk & Support Cross-Site Scripting (3.2.9)
WordPress Plugin YaySMTP-Simple WP SMTP Mail Cross-Site Scripting (2.2)
WordPress Plugin Event List Cross-Site Scripting (0.7.9)
WordPress Plugin Limit Login Attempts Cross-Site Scripting (1.7.1)