Kevin Barbón García

The issue arises from the plugin's failure to properly escape the current page URL before reusing it in an HTML attribute, leading to a reflected cross-site scripting vulnerability.