Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
				$diff = array_diff_assoc( $v, $this->esi_args[ $k ] );
				if ( ! empty( $diff ) ) {
					$esi_args[ $k ] = $diff;
				}
			}
			elseif ( $v !== $this->esi_args[ $k ] ) {
				$esi_args[ $k ] = $v;
			}
		}