---
title: "User Controllable HTML Element Attribute (Potential XSS)"
description: "HawkScan test information for plugin 10031: User Controllable HTML Element Attribute (Potential XSS)"
url: https://docs.stackhawk.com/vulnerabilities/10031/
---

[Back to Index](https://docs.stackhawk.com/vulnerabilities/)

# User Controllable HTML Element Attribute (Potential XSS)

###### Reference

- **Plugin ID:** 10031
- [**CWE:** 20](https://cwe.mitre.org/data/definitions/20.html)
- **WASC:** 20
- **Risk:** Unknown
- **Type:** Passive
- **Category:** Injection

###### Resource

- <https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html>

### Remediation\n\n1. **Input validation**: Implement strict validation for all user input that might be reflected in HTML attributes.\n2. **Output encoding**: Properly encode all user data before inserting it into HTML attributes using context-appropriate encoding.\n3. **Content Security Policy**: Implement CSP headers to mitigate potential XSS attacks.\n4. **Use safe APIs**: Utilize framework-provided safe APIs for generating HTML content that automatically handle encoding.\n\n### About\n\nUser Controllable HTML Element Attribute vulnerabilities occur when user input can directly influence HTML attribute values without proper validation or encoding. This creates potential injection points for cross-site scripting (XSS) attacks where malicious scripts could be injected into HTML attributes.\n\n### Risks\n\n**High** This vulnerability can lead to cross-site scripting attacks, session hijacking, credential theft, malware injection, and complete compromise of user sessions and sensitive data.