Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
        foreach ($news as $item) {
            $url = sprintf(
                '%sindex.php?action=news&amp;newsid=%d&amp;newslang=%s',
                $this->config->getDefaultUrl(),
                $item['id'],
                $item['lang']
            );
            $oLink = new Link($url, $this->config);

            if (isset($item['header'])) {
                $oLink->itemTitle = $item['header'];
            }

            $output .= sprintf(
                '<h6%s><a id="news_%d" href="%s">%s <i aria-hidden="true" class="fa fa-caret-right"></i></a></h6>',
                ' class="pmf-news-heading"',
                $item['id'],
                $oLink->toString(),
                $item['header']
            );

            $output .= sprintf('%s', $item['content']);

            if (strlen($item['link']) > 1) {
                $output .= sprintf(
                    '<br>%s <a href="%s" target="_%s">%s</a>',
                    $this->pmfLang['msgInfo'],
                    $item['link'],
                    $item['target'],
                    $item['linkTitle']
                );
            }

            $output .= sprintf('<small class="text-muted">%s</small>', $date->format($item['date']));
        }