Description
An attacker can control one or more parameter values of a sensitive HTML tag (e.g. link href). In some conditions this can cause security issues such as XSS (cross-site scripting).
Remediation
Your script should properly sanitize user input. Do not allow user-input to fully control important parameter tag values.
References
OWASP - Cross Site Scripting (XSS)
CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Related Vulnerabilities
WordPress Plugin Indeed Job Importer Cross-Site Scripting (1.0.5)
WordPress Plugin WooCommerce Export Orders and More Cross-Site Scripting (2.0.10)
WordPress Plugin Slider Hero with Animation, Video Background Cross-Site Scripting (8.4.3)
Drupal Core 9.0.x Cross-Site Scripting (9.0.0 - 9.0.14)
WordPress Plugin WPS Limit Login Multiple Vulnerabilities (1.4.5)