Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
	private function _parse_esi_param( $qs_params = false ) {
		$req_params = false;
		if ( $qs_params ) {
			$req_params = $qs_params;
		}
		elseif ( isset( $_REQUEST[ self::QS_PARAMS ] ) ) {
			$req_params = $_REQUEST[ self::QS_PARAMS ];
		}

		if ( ! $req_params ) {
			return false;
		}

		$unencrypted = base64_decode( $req_params );
		if ( $unencrypted === false ) {
			return false;
		}

		Debug2::debug2( '[ESI] parms', $unencrypted );
		// $unencoded = urldecode($unencrypted); no need to do this as $_GET is already parsed
		$params = json_decode( $unencrypted, true );

		return $params;
	}