Description

The src parameter for one script tag from this page is dirrectly controlled by user input. An attacker who can control the reference location to a JavaScript source file can load a script of their choice into an application.

Remediation

Your script should properly sanitize user input. Do not allow user-input to control script source location references.

References

OWASP - Cross Site Scripting (XSS)

CWE-829: Inclusion of Functionality from Untrusted Control Sphere

Related Vulnerabilities

WordPress Plugin PowerPack Addons for Elementor Multiple Cross-Site Scripting Vulnerabilities (2.3.1)

WordPress Plugin WP-Polls Cross-Site Scripting (2.69)

WordPress Plugin WPCafe-Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce Cross-Site Scripting (2.2.24)

WordPress Plugin Pay With Tweet SQL Injection and Cross-Site Scripting Vulnerabilities (1.1)

WordPress Plugin WP-TopBar Cross-Site Scripting and Cross-Site Request Forgery Vulnerabilities (4.02)

Severity

High

Classification

CWE-79 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N

Tags

XSS