Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
	private function _register_not_esi_actions() {
		do_action( 'litespeed_tpl_normal' );

		if ( ! Control::is_cacheable() ) {
			return;
		}

		if ( Router::is_ajax() ) {
			return;
		}

		add_filter('widget_display_callback', array( $this, 'sub_widget_block' ), 0, 3);

		// Add admin_bar esi
		if ( Router::is_logged_in() ) {
			remove_action('wp_footer', 'wp_admin_bar_render', 1000);
			add_action('wp_footer', array($this, 'sub_admin_bar_block'), 1000);
		}

		// Add comment forum esi for logged-in user or commenter
		if ( ! Router::is_ajax() && Vary::has_vary() ) {
			add_filter( 'comment_form_defaults', array( $this, 'register_comment_form_actions' ) );
		}

	}