Security fixes

lloc · Sep 23, 2024 · 603ec7d · 603ec7d
1 parent 6613f79
commit 603ec7d
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 3 deletions.
diff --git a/includes/MslsCustomColumn.php b/includes/MslsCustomColumn.php
@@ -94,7 +94,7 @@ public function td( $column_name, $item_id ): void {
 					printf(
 						'<span class="msls-icon-wrapper %1$s">%2$s</span>',
 						esc_attr( $this->options->get_icon_type() ),
-						$icon->get_a()
+						wp_kses_post( $icon->get_a() )
 					);
 
 					restore_current_blog();

diff --git a/includes/MslsPostTag.php b/includes/MslsPostTag.php
@@ -179,7 +179,7 @@ public function the_input( ?\WP_Term $tag, string $title_format, string $item_fo
 					}
 				}
 
-				printf( wp_kses_post( $item_format ), esc_attr( $blog->userblog_id ), $icon, esc_attr( $language ), esc_attr( $value ), esc_attr( $title ) );
+				printf( wp_kses_post( $item_format ), esc_attr( $blog->userblog_id ), wp_kses_post( $icon ), esc_attr( $language ), esc_attr( $value ), esc_attr( $title ) );
 
 				restore_current_blog();
 			}

diff --git a/includes/MslsPostTagClassic.php b/includes/MslsPostTagClassic.php
@@ -126,7 +126,7 @@ public function print_option( MslsBlog $blog, string $type, MslsOptionsTax $myda
 			}
 		}
 
-		printf( wp_kses_post( $item_format ), esc_attr( $language ), $icon, $options );
+		printf( wp_kses_post( $item_format ), esc_attr( $language ), wp_kses_post( $icon ), wp_kses_post( $options ) );
 
 		restore_current_blog();
 	}