Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
!function(){var t;t=jQuery,Craft.QuickPostWidget=Garnish.Base.extend({params:null,initFields:null,formHtml:null,$widget:null,$form:null,$spinner:null,$errorList:null,loading:!1,init:function(i,r,e,n){this.params=r,this.initFields=e,this.formHtml=n,this.$widget=t("#widget"+i),this.initForm(this.$widget.find("form:first"))},initForm:function(t){this.$form=t,this.$spinner=this.$form.find(".spinner"),this.initFields();var i=this.$form.find("> .buttons > .btngroup > .menubtn"),r=i.data("menubtn").menu.$container.find("> ul > li > a");i.menubtn(),this.addListener(this.$form,"submit","handleFormSubmit"),this.addListener(r,"click","saveAndContinueEditing")},handleFormSubmit:function(t){t.preventDefault(),this.save(this.onSave.bind(this))},saveAndContinueEditing:function(){this.save(this.gotoEntry.bind(this))},save:function(i){var r=this;if(!this.loading){this.loading=!0,this.$spinner.removeClass("hidden");var e=Garnish.getPostData(this.$form),n=t.extend({enabled:1},e,this.params);Craft.postActionRequest("entries/save-entry",n,(function(e,n){if(r.loading=!1,r.$spinner.addClass("hidden"),r.$errorList&&r.$errorList.children().remove(),"success"===n)if(e.success)Craft.cp.displayNotice(Craft.t("app","Entry saved.")),i(e);else if(Craft.cp.displayError(Craft.t("app","Couldn’t save entry.")),e.errors)for(var s in r.$errorList||(r.$errorList=t('<ul class="errors"/>').insertAfter(r.$form)),e.errors)if(e.errors.hasOwnProperty(s))for(var a=0;a<e.errors[s].length;a++){var o=e.errors[s][a];t("<li>"+o+"</li>").appendTo(r.$errorList)}}))}},onSave:function(i){var r=t(this.formHtml);if(this.$form.replaceWith(r),Craft.initUiElements(r),this.initForm(r),void 0!==Craft.RecentEntriesWidget)for(var e=0;e<Craft.RecentEntriesWidget.instances.length;e++){var n=Craft.RecentEntriesWidget.instances[e];n.params.sectionId&&n.params.sectionId!=this.params.sectionId||n.addEntry({url:i.cpEditUrl,title:i.title,dateCreated:i.dateCreated,username:i.authorUsername})}},gotoEntry:function(t){Craft.redirectTo(t.cpEditUrl)}})}();