Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
	public function shortcode( $atts ) {
		if ( empty( $atts[ 0 ] ) ) {
			Debug2::debug( '[ESI] ===shortcode wrong format', $atts );
			return 'Wrong shortcode esi format';
		}

		$cache = 'public,no-vary';
		if ( ! empty( $atts[ 'cache' ] ) ) {
			$cache = $atts[ 'cache' ];
			unset( $atts[ 'cache' ] );
		}

		$silence = false;
		if ( ! empty( $atts[ '_ls_silence' ] ) ) {
			$silence = true;
		}

		do_action( 'litespeed_esi_shortcode-' . $atts[ 0 ] );

		// Show ESI link
		return $this->sub_esi_block( 'esi', 'esi-shortcode', $atts, $cache, $silence );
	}