Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
	public function register_comment_form_actions( $defaults ) {
		$this->esi_args = $defaults;
		echo GUI::clean_wrapper_begin();
		add_filter( 'comment_form_submit_button', array( $this, 'sub_comment_form_btn' ), 1000, 2 ); // To save the params passed in
		add_action( 'comment_form', array( $this, 'sub_comment_form_block' ), 1000 );
		return $defaults;
	}