Description
The src parameter for one script tag from this page is dirrectly controlled by user input. An attacker who can control the reference location to a JavaScript source file can load a script of their choice into an application.
Remediation
Your script should properly sanitize user input. Do not allow user-input to control script source location references.
References
OWASP - Cross Site Scripting (XSS)
CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Related Vulnerabilities
WordPress Plugin Wordfence Security-Firewall & Malware Scan Cross-Site Scripting (7.6.0)
WordPress Plugin AMP extensions Cross-Site Scripting (1.1)
WordPress Plugin WP Statistics Multiple Cross-Site Scripting Vulnerabilities (12.0.4)
WordPress Plugin WP Geoloc Cross-Site Scripting (1.0.0)
WordPress Plugin Audio 'showfile' Parameter Cross-Site Scripting (0.5.1)