Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
	public function is_nonce_action( $action ) {
		// If GM not run yet, then ESI not init yet, then ESI nonce will not be allowed even nonce func replaced.
		if ( ! defined( 'LITESPEED_ESI_INITED' ) ) {
			return null;
		}

		if ( is_admin() ) {
			return null;
		}

		if ( defined( 'LITESPEED_ESI_OFF' ) ) {
			return null;
		}

		foreach ( $this->_nonce_actions as $k => $v ) {
			if ( strpos( $k, '*' ) !== false ) {
				if( preg_match( '#' . $k . '#iU', $action ) ) {
					return $v;
				}
			}
			else {
				if ( $k == $action ) {
					return $v;
				}
			}
		}

		return null;
	}