Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
            . page_link_to('angeltypes', ['action' => 'view', 'angeltype_id' => $user_angeltype->angel_type_id])
            . '">' . $user_angeltype->angelType->name
            . ' (+' . $user_angeltype->count . ')'
            . '</a>';
    }

    $count = $unconfirmed_user_angeltypes->count();
    return
        _e(
            'There is %d unconfirmed angeltype.',
            'There are %d unconfirmed angeltypes.',
            $count,
            [$count]
        )
        . ' ' . __('Angel types which need approvals:')
        . ' ' . join(', ', $unconfirmed_links);
}