[dgb23]

PHP is uniquely vulnerable to things like XSS and others on that list, because it does escape strings that are used in templating.

Escaping by default has become a standard practice with HTML templating languages, see the Go html template standard library for a very detailed breakdown of what is escaped where.

More modern PHP frameworks like Laravel provide their own templating solution in part because of this. But the vast majority of websites run on default PHP templates, so it's not surprising that these kinds of vulnerabilities are so high up in the list.

[jacquesm]

Laravel has had their own share of XSS issues with their Blade templating engine.

The whole problem is that you mix code and data, and that third party resource loading is 'on' by default in browsers, especially for scripts and things that can embed scripts. This is not something you can fix once and for all at the library level.