Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
(function(){function h(u){if(u&&null!=LucidImporter.imgSrcRepl){var F=LucidImporter.imgSrcRepl.attMap;if(F[u])u=F[u];else{F=LucidImporter.imgSrcRepl.imgRepl;for(var C=0;C<F.length;C++){var t=F[C];u=u.replace(t.searchVal,t.replVal)}LucidImporter.hasExtImgs=!0}}return u}function y(u){lb="";try{if(u){var F=null;LucidImporter.advImpConfig&&LucidImporter.advImpConfig.fontMapping&&(F=LucidImporter.advImpConfig.fontMapping[u]);if(F){for(var C in F)lb+=C+"="+F[C]+";";return F.fontFamily?"font-family: "+F.fontFamily:
""}if("Liberation Sans"!=u)return lb="fontFamily="+u+";","font-family: "+u+";"}}catch(t){}return""}function A(u){return Math.round(10*u)/10}function B(u,F,C){function t(la,Ma){var ya="",za=la.t,Qb=la.l||{v:za&&"ul"==za.v?"auto":"decimal"};if(null==za||0!=Na&&Na==za.v&&Ka==Qb.v)null==za&&(Na&&(ya+=N(!0),Na=!1),ya+='<div style="',Ca.push("div"));else{Na&&(ya+=N(!0));Na=za.v;Ka=Qb.v;"ul"==za.v?(ya+="<ul ",Ca.push("ul")):(ya+="<ol ",Ca.push("ol"));ya+='style="margin: 0px; padding-left: 10px;list-style-position: inside; list-style-type:';