Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
	public function load_admin_bar_block( $params ) {

		if ( ! empty( $params[ 'ref' ] ) ) {
			$ref_qs = parse_url( $params[ 'ref' ], PHP_URL_QUERY );
			if ( ! empty( $ref_qs ) ) {
				parse_str( $ref_qs, $ref_qs_arr );

				if ( ! empty( $ref_qs_arr ) ) {
					foreach ( $ref_qs_arr as $k => $v ) {
						$_GET[ $k ] = $v;
					}
				}
			}
		}

		wp_admin_bar_render();
		if ( ! $this->conf( Base::O_ESI_CACHE_ADMBAR ) ) {
			Control::set_nocache( 'build-in set to not cacheable' );
		}
		else {
			Control::set_private();
			Control::set_no_vary();
		}

		defined( 'LSCWP_LOG' ) && Debug2::debug( 'ESI: adminbar ref: ' . $_SERVER[ 'REQUEST_URI' ] );
	}