Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
			$qs = parse_url( htmlspecialchars_decode( $url ), PHP_URL_QUERY );
			parse_str( $qs, $qs );
			if ( empty( $qs[ self::QS_ACTION ] ) ) {
				continue;
			}
			$esi_id = $qs[ self::QS_ACTION ];
			$esi_param = ! empty( $qs[ self::QS_PARAMS ] ) ? $this->_parse_esi_param( $qs[ self::QS_PARAMS ] ) : false;
			$inline_param = apply_filters( 'litespeed_esi_inline-' . $esi_id, array(), $esi_param ); // Returned array need to be [ val, control, tag ]
			if ( $inline_param ) {
				$output .= self::_build_inline( $url, $inline_param );
			}
		}