Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
	public function finalize( $buffer ) {
		// Prepend combo esi block
		if ( self::$_combine_ids ) {
			Debug2::debug( '[ESI] 🍔 Enabled combo' );
			$esi_block = $this->sub_esi_block( self::COMBO, '__COMBINE_MAIN__', array(), 'no-cache', true );
			$buffer = $esi_block . $buffer;
		}

		// Bypass if no preserved list to be replaced
		if ( ! $this->_esi_preserve_list ) {
			return $buffer;
		}

		$keys = array_keys( $this->_esi_preserve_list );

		Debug2::debug( '[ESI] replacing preserved blocks', $keys );

		$buffer = str_replace( $keys, $this->_esi_preserve_list, $buffer );

		return $buffer;
	}