Web::Simple versions prior to 0.037 for Perl do not properly escape single quotes in HTML::Tags output. This allows an attacker who controls a value interpolated into a single-quoted HTML attribute to inject script code by closing the attribute early and adding malicious attributes. Double-quoted attributes are not affected.