Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function is_live_edit()
{
    if (!is_admin()) {
        return false;
    }


    $editModeParam = app()->url_manager->param('editmode');
    if ($editModeParam == 'n') {
        return false;
    }


    $editModeParam = app()->url_manager->param('editmode');
    if ($editModeParam == 'y') {
        return true;
    }

    $editModeParam2 = app()->url_manager->param('editmode',true);
    if ($editModeParam2 == 'y') {
        return true;
    }

    if(defined('IN_EDIT') and IN_EDIT){
        return true;
    }

    $editModeSession = app()->user_manager->session_get('editmode');

    if ($editModeSession == true and !defined('IN_EDIT')) {
        define('IN_EDIT', true);
        return true;
    }

    return $editModeSession;
}