Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
	public function sub_widget_block( $instance, $widget, $args ) {
		// #210407
		if ( ! is_array( $instance ) ) {
			return $instance;
		}

		$name = get_class( $widget );
		if ( ! isset( $instance[ Base::OPTION_NAME ] ) ) {
			return $instance;
		}
		$options = $instance[ Base::OPTION_NAME ];
		if ( ! isset( $options ) || ! $options[ self::WIDGET_O_ESIENABLE ] ) {
			defined( 'LSCWP_LOG' ) && Debug2::debug( 'ESI 0 ' . $name . ': '. ( ! isset( $options ) ? 'not set' : 'set off' ) );

			return $instance;
		}