Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
	public function sub_admin_bar_block() {
		global $wp_admin_bar;

		if ( ! is_admin_bar_showing() || ! is_object($wp_admin_bar) ) {
			return;
		}

		// To make each admin bar ESI request different for `Edit` button different link
		$params = array(
			'ref' => $_SERVER[ 'REQUEST_URI' ],
		);

		echo $this->sub_esi_block( 'admin-bar', 'adminbar', $params );
	}