Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
                $template->addJSFromContext('wysiwyg/redactor/files/plugins/'.$plugin.'/'.$plugin.'.js');
            }

            if (in_array('clips', $this->options['plugins'])){
                $this->options['clipsUrl'] = href_to('wysiwyg/redactor/files/plugins/clips/index.html');
            }
        }

        if($this->lang !== 'en'){
            $template->addJSFromContext('wysiwyg/redactor/files/lang/'.$this->lang.'.js');
        }

        ob_start(); ?>

        <script>
            var redactor_global_options = {};
            function init_redactor (dom_id){
                var imperavi_options = {};
                if(redactor_global_options.hasOwnProperty('field_'+dom_id)){
                    imperavi_options = redactor_global_options['field_'+dom_id];
                } else if(redactor_global_options.hasOwnProperty('default')) {
                    imperavi_options = redactor_global_options.default;
                }
                icms.files.url_delete = '<?php echo href_to('files', 'delete'); ?>';
                imperavi_options.imageDeleteCallback = function (element){
                    if(confirm('<?php echo LANG_PARSER_IMAGE_DELETE; ?>')){
                        icms.files.deleteByPath($(element).attr('src'));
                    }
                };
                $('#'+dom_id).redactor(imperavi_options);
                icms.forms.addWysiwygsInsertPool(dom_id, function(field_element, text){
                    $('#'+field_element).redactor('set', text);
                    $('#'+field_element).redactor('focus');
                });
                icms.forms.addWysiwygsAddPool(dom_id, function(field_element, text){
                    $('#'+field_element).redactor('insertHtml', text);
                });
            }
        </script>

        <?php $template->addBottom(ob_get_clean());

        self::$redactor_loaded = true;

    }