Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
	public function load_esi_block() {
		/**
		 * Validate if is a legal ESI req
		 * @since 2.9.6
		 */
		if ( empty( $_GET[ '_hash' ] ) || $this->_gen_esi_md5( $_GET ) != $_GET[ '_hash' ] ) {
			Debug2::debug( '[ESI] ❌ Failed to validate _hash' );
			return;
		}

		$params = $this->_parse_esi_param();

		if ( defined( 'LSCWP_LOG' ) ) {
			$logInfo = '[ESI] ⭕ ';
			if( ! empty( $params[ self::PARAM_NAME ] ) ) {
				$logInfo .= ' Name: ' . $params[ self::PARAM_NAME ] . ' ----- ';
			}
			$logInfo .= ' [ID] ' . LSCACHE_IS_ESI;
			Debug2::debug( $logInfo );
		}

		if ( ! empty( $params[ '_ls_silence' ] ) ) {
			! defined( 'LSCACHE_ESI_SILENCE' ) && define( 'LSCACHE_ESI_SILENCE', true );
		}

		/**
		 * Buffer needs to be JSON format
		 * @since  2.9.4
		 */
		if ( ! empty( $params[ 'is_json' ] ) ) {
			add_filter( 'litespeed_is_json', '__return_true' );
		}

		Tag::add( rtrim( Tag::TYPE_ESI, '.' ) );
		Tag::add( Tag::TYPE_ESI . LSCACHE_IS_ESI );

		// Debug2::debug(var_export($params, true ));

		/**
		 * Handle default cache control 'private,no-vary' for sub_esi_block() 	@ticket #923505
		 *
		 * @since  2.2.3
		 */
		if ( ! empty( $_GET[ '_control' ] ) ) {
			$control = explode( ',', $_GET[ '_control' ] );
			if ( in_array( 'private', $control ) ) {
				Control::set_private();
			}

			if ( in_array( 'no-vary', $control ) ) {
				Control::set_no_vary();
			}
		}

		do_action('litespeed_esi_load-' . LSCACHE_IS_ESI, $params);
	}