Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
        foreach ($allUsers as $userId) {
            if (-1 !== $userId) {
                $this->user->getUserById($userId);
                $options .= sprintf(
                    '<option value="%d" %s>%s (%s)</option>',
                    $userId,
                    (($userId === $id) ? 'selected' : ''),
                    $this->user->getUserData('display_name'),
                    $this->user->getLogin()
                );
            }
        }