Description
An attacker can control one or more parameter values of a sensitive HTML tag (e.g. link href). In some conditions this can cause security issues such as XSS (cross-site scripting).
Remediation
Your script should properly sanitize user input. Do not allow user-input to fully control important parameter tag values.
References
OWASP - Cross Site Scripting (XSS)
CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Related Vulnerabilities
WordPress Plugin Timetable and Event Schedule by MotoPress Cross-Site Scripting (2.3.18)
WordPress Plugin PhoneTrack Meu Site Manager Cross-Site Scripting (0.1)
WordPress Plugin Widget for Facebook Page Feeds Cross-Site Scripting (5.0)
WordPress Plugin XML Sitemap & Google News feeds Cross-Site Scripting (3.9)
WordPress Plugin Uploader 'num' Parameter Cross-Site Scripting (1.0.0)