Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function alert(NotificationType $type, $msg, $immediately = false)
{
    if (empty($msg)) {
        return '';
    }

    if ($immediately) {
        $type = str_replace(
            [
                NotificationType::ERROR->value,
                NotificationType::WARNING->value,
                NotificationType::INFORMATION->value,
                NotificationType::MESSAGE->value,
            ],
            ['danger', 'warning', 'info', 'success'],
            $type->value
        );
        return '<div class="alert alert-' . $type . '" role="alert">' . $msg . '</div>';
    }

    $type = 'messages.' . $type->value;
    $session = session();
    $messages = $session->get($type, []);
    $messages[] = $msg;
    $session->set($type, $messages);

    return '';
}