Versions of i18nextify prior to 4.0.8 allow unvalidated substitution of translation strings into href and src attributes, enabling DOM-based cross-site scripting (XSS) via javascript:, data:, vbscript:, or file: URL schemes. This occurs when an attacker can control translation content, such as through compromised translation files or man-in-the-middle attacks. The vulnerability is fixed in version 4.0.8 by blocking these dangerous URL schemes before insertion into the DOM.