Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
	private function _hooks() {
		add_filter( 'template_include', array( $this, 'esi_template' ), 99999 );

		add_action( 'load-widgets.php', __NAMESPACE__ . '\Purge::purge_widget' );
		add_action( 'wp_update_comment_count', __NAMESPACE__ . '\Purge::purge_comment_widget' );

		/**
		 * Recover REQUEST_URI
		 * @since  1.8.1
		 */
		if ( ! empty( $_GET[ self::QS_ACTION ] ) ) {
			$this->_register_esi_actions();
		}

		/**
		 * Shortcode ESI
		 *
		 * To use it, just change the origianl shortcode as below:
		 * 		old: [someshortcode aa='bb']
		 * 		new: [esi someshortcode aa='bb' cache='private,no-vary' ttl='600']
		 *
		 * 	1. `cache` attribute is optional, default to 'public,no-vary'.
		 * 	2. `ttl` attribute is optional, default is your public TTL setting.
		 *  3. `_ls_silence` attribute is optional, default is false.
		 *
		 * @since  2.8
		 * @since  2.8.1 Check is_admin for Elementor compatibility #726013
		 */
		if ( ! is_admin() ) {
			add_shortcode( 'esi', array( $this, 'shortcode' ) );
		}

	}