Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
	public function load_widget_block( $params ) {
		// global $wp_widget_factory;
		// $widget = $wp_widget_factory->widgets[ $params[ self::PARAM_NAME ] ];
		$option = $params[ self::PARAM_INSTANCE ];
		$option = $option[ Base::OPTION_NAME ];

		// Since we only reach here via esi, safe to assume setting exists.
		$ttl = $option[ self::WIDGET_O_TTL ];
		defined( 'LSCWP_LOG' ) && Debug2::debug( 'ESI widget render: name ' . $params[ self::PARAM_NAME ] . ', id ' . $params[ self::PARAM_ID ] . ', ttl ' . $ttl );
		if ( $ttl == 0 ) {
			Control::set_nocache( 'ESI Widget time to live set to 0' );
		}
		else {
			Control::set_custom_ttl( $ttl );

			if ( $option[ self::WIDGET_O_ESIENABLE ] == Base::VAL_ON2 ) {
				Control::set_private();
			}
			Control::set_no_vary();
			Tag::add( Tag::TYPE_WIDGET . $params[ self::PARAM_ID ] );
		}
		the_widget( $params[ self::PARAM_NAME ], $params[ self::PARAM_INSTANCE ], $params[ self::PARAM_ARGS ] );
	}