Inline HTML in shortcode titles now escaped

  • shrestharavee1

    (@shrestharavee1)


    1 week, 2 days ago

    Hi,

    After the recent update, inline HTML in shortcode title attributes renders as literal text instead of markup.

    Before:

    [toggle title="<strong>Accounting</strong>"]

    rendered a bold accordion title.

    Now: the same shortcode outputs &lt;strong&gt;Accounting&lt;/strong&gt; as visible text.

    Cause

    In includes/class-ebs-sanitizer.php, Sanitizer::html() is a direct wrapper around esc_html(). It’s called on ~10 title/label attributes across the shortcodes:

    • shortcode/toggles/plugin_shortcode.php:53 — title
    • shortcode/tabs/plugin_shortcode.php:53 — title
    • shortcode/buttons/plugin_shortcode.php:25 — title
    • shortcode/slider/plugin_shortcode.php:137,139 — title, caption
    • shortcode/progressbar/plugin_shortcode.php:27 — label
    • shortcode/servicebox/plugin_shortcode.php:50,54 — heading, readmore_text
    • shortcode/badge/plugin_shortcode.php:37 — value
    • shortcode/oscpopover/plugin_shortcode.php:68 — button_text

    I understand the escaping was added as XSS hardening, and I’m not asking you to drop it. But esc_html() is stricter than necessary for these fields, and it silently breaks existing content on every site that used inline formatting in titles.

You must be logged in to reply to this topic.