Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
	public function sub_comment_form_block( $post_id ) {
		echo GUI::clean_wrapper_end();
		$params = array(
			self::PARAM_ID => $post_id,
			self::PARAM_ARGS => $this->esi_args,
		);

		echo $this->sub_esi_block( 'comment-form', 'comment form', $params );
		echo GUI::clean_wrapper_begin();
		add_action( 'comment_form_after', array( $this, 'comment_form_sub_clean' ) );
	}