Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
(function(){function h(u){if(u&&null!=LucidImporter.imgSrcRepl){var F=LucidImporter.imgSrcRepl.attMap;if(F[u])u=F[u];else{F=LucidImporter.imgSrcRepl.imgRepl;for(var C=0;C<F.length;C++){var t=F[C];u=u.replace(t.searchVal,t.replVal)}LucidImporter.hasExtImgs=!0}}return u}function y(u){lb="";try{if(u){var F=null;LucidImporter.advImpConfig&&LucidImporter.advImpConfig.fontMapping&&(F=LucidImporter.advImpConfig.fontMapping[u]);if(F){for(var C in F)lb+=C+"="+F[C]+";";return F.fontFamily?"font-family: "+F.fontFamily: