                        firstname: l.attr('data-firstname')
                    });
                    l.append(`
                     <div class="member-details">
                        ${member_item}
                        ${l.attr('data-name') || `${member_itemtype} (${member_items_id})`}
                     </div>
                     <button type="button" name="delete" class="btn btn-ghost-danger">
                        <i class="ti ti-x" title="${__('Delete')}"></i>
                     </button>
                  `);
                });
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.