Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
	public static function widget_default_options($options, $widget) {
		if ( ! is_array($options) ) {
			return $options;
		}

		$widget_name = get_class($widget);
		switch ($widget_name) {
			case 'WP_Widget_Recent_Posts' :
			case 'WP_Widget_Recent_Comments' :
				$options[self::WIDGET_O_ESIENABLE] = Base::VAL_OFF;
				$options[self::WIDGET_O_TTL] = 86400;
				break;
			default :
				break;
		}
		return $options;
	}