Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
	private function _register_esi_actions() {
		! defined( 'LSCACHE_IS_ESI' ) && define( 'LSCACHE_IS_ESI', $_GET[ self::QS_ACTION ] );// Reused this to ESI block ID

		! empty( $_SERVER[ 'ESI_REFERER' ] ) && defined( 'LSCWP_LOG' ) && Debug2::debug( '[ESI] ESI_REFERER: ' . $_SERVER[ 'ESI_REFERER' ] );

		/**
		 * Only when ESI's parent is not REST, replace REQUEST_URI to avoid breaking WP5 editor REST call
		 * @since 2.9.3
		 */
		if ( ! empty( $_SERVER[ 'ESI_REFERER' ] ) && ! $this->cls( 'REST' )->is_rest( $_SERVER[ 'ESI_REFERER' ] ) ) {
			$_SERVER[ 'REQUEST_URI' ] = $_SERVER[ 'ESI_REFERER' ];
		}

		if ( ! empty( $_SERVER[ 'ESI_CONTENT_TYPE' ] ) && strpos( $_SERVER[ 'ESI_CONTENT_TYPE' ], 'application/json' ) === 0 ) {
			add_filter( 'litespeed_is_json', '__return_true' );
		}

		/**
		 * Make REST call be able to parse ESI
		 * NOTE: Not effective due to ESI req are all to `/` yet
		 * @since 2.9.4
		 */
		add_action( 'rest_api_init', array( $this, 'load_esi_block' ), 101 );

		// Register ESI blocks
		add_action('litespeed_esi_load-widget', array($this, 'load_widget_block'));
		add_action('litespeed_esi_load-admin-bar', array($this, 'load_admin_bar_block'));
		add_action('litespeed_esi_load-comment-form', array($this, 'load_comment_form_block'));

		add_action('litespeed_esi_load-nonce', array( $this, 'load_nonce_block' ) );
		add_action('litespeed_esi_load-esi', array( $this, 'load_esi_shortcode' ) );

		add_action('litespeed_esi_load-' . self::COMBO, array( $this, 'load_combo' ) );
	}