esc_html on $value_array and $valueAr

First off, thanks for this plugin. Its great.

Now I just noticed something that may/may not be by design. Essentially when you output the content of meta, you’re not escaping the value. For cases where your meta can contain script tags they will execute on the edit screen.

Consider the following:

foreach ( $value as $name_array => $value_array ) {
    echo $name_array . '  =>  ' . esc_html( $value_array );
    echo var_dump( $value_array );
}

Without the esc_html, the following immediately redirects you to another page. If this was on a server I don’t know a lot of people that would be able to modify and stop the code from executing.

<script>
    window.location = "http://www.example.com";
</script>

If this is by design, it is what it is. But if you’re not opposed to escaping the output I would highly recommend it.

Thanks!

https://wordpress.org/plugins/debug-meta-data/