Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
	public function init() {
		/**
		 * Bypass ESI related funcs if disabled ESI to fix potential DIVI compatibility issue
		 * @since  2.9.7.2
		 */
		if ( Router::is_ajax() || ! $this->cls( 'Router' )->esi_enabled() ) {
			return;
		}

		// Guest mode, don't need to use ESI
		if ( defined( 'LITESPEED_GUEST' ) && LITESPEED_GUEST ) {
			return;
		}

		if ( defined( 'LITESPEED_ESI_OFF' ) ) {
			return;
		}

		// Init ESI in `after_setup_theme` hook after detected if LITESPEED_DISABLE_ALL is ON or not
		$this->_hooks();

		/**
		 * Overwrite wp_create_nonce func
		 * @since  2.9.5
		 */
		$this->_transform_nonce();

		! defined( 'LITESPEED_ESI_INITED' ) && define( 'LITESPEED_ESI_INITED', true );
	}