Following a report by https://www.openbugbounty.org/reports/3084209/ I fixed the affected function found in /include/helper.php by adding Hsc(): public static function SelfPath() { return ROOT_URL . Hsc($_SERVER['PHP_SELF']); }