What is invalid character entity &ccb

I've this playground: https://go.dev/play/p/uEpYEWaQaV0
But did not get what is the issue and why it is not working! and I'm getting the error:

invalid character entity &ccb

My code is:

package main

import (
	"encoding/xml"
	"fmt"
)

type catalog struct {
	Id string `xml:"id"`
}

type price struct {
	Subtotal    int    `xml:"subtotal"`
	Currency    string `xml:"currency"`
	Total       int    `xml:"total"`
	PriceStatus string `xml:"price_status"`
}

type image struct {
	Url string `xml:"url"`
	Id  int    `xml:"id"`
}

type product struct {
	Id         int    `xml:"id"`
	RetailerId int    `xml:"retailer_id"`
	Image      image  `xml:"image"`
	Price      int    `xml:"price"`
	Currency   string `xml:"currency"`
	Name       string `xml:"name"`
	Quantity   int    `xml:"quantity"`
}

type order struct {
	Product product `xml:"product"`
	Catalog catalog `xml:"catalog"`
	Price   price   `xml:"price"`
}

type Iq struct {
	XMLName xml.Name `xml:"iq"`
	Order   order    `xml:"order"`
}

func main() {
	contents := `<iq from="s.whatsapp.net" id="162.120-3" type="result">
  <order creation_ts="1651703902" id="1046755402590219">
    <product>
      <id>8312993582051445</id>
      <retailer_id>291</retailer_id>
      <image>
        <url>https://mmg.whatsapp.net/v/t45.5328-4/279646282_7510595942346471_4295336878174066544_n.jpg?stp=dst-jpg_p100x100&ccb=1-5&_nc_sid=c48759&_nc_ohc=OMyHhkGxzRoAX8Dn93Q&_nc_ad=z-m&_nc_cid=0&_nc_ht=mmg.whatsapp.net&oh=01_AVw_0loIIuK1LP-n5OL1hdpRmNYhAiUjLGk20FCclgNXCA&oe=62774C93</url>
        <id>7510595939013138</id>
      </image>
      <price>5000</price>
      <currency>SAR</currency>
      <name>coffee</name>
      <quantity>1</quantity>
    </product>
    <catalog><id>326185462964376</id></catalog>
    <price>
      <subtotal>5000</subtotal>
      <currency>SAR</currency>
      <total>5000</total>
      <price_status>provided</price_status>
    </price>
  </order>
</iq>`

	iq := &Iq{}

	err := xml.Unmarshal([]byte(contents), &iq)
	if err != nil {
		panic(err)
	}
	fmt.Printf("%v\n", iq.Order)
}

Building on the answer from @collapsar...

Despite the XML being malformed, you can still process it by creating a Decoder instance and turning off Strict mode:

d := xml.NewDecoder(bytes.NewReader([]byte(contents)))
d.Strict = false
err := d.Decode(&iq)
if err != nil {
panic(err)
}
fmt.Printf("%v\n", iq.Order)

Go Playground

For reference, see https://pkg.go.dev/encoding/xml#Decoder.

The xml in your code is not well-formed.

The xml fragment contains an element url which contains a url with multiple parameters in its query string portion, separated by ampersands &.

This symbol has special semantics in xml in initiating an entity reference (kind of a symbolic constant) - you cannot use it in isolation.

Either write the url as a CDATA section (the contents of which are considered a literal, Syntax: <![CDATA[...]]>) or replace all occurrences of & with & (using the entity reference for the sports and symbol; effectively used here as an escaping mechanism).