{"id":19003911,"date":"2026-08-26T18:45:28","date_gmt":"2026-08-26T18:45:28","guid":{"rendered":"https:\/\/wordpress.org\/support\/topic\/inline-html-in-shortcode-titles-now-escaped\/"},"modified":"2026-08-26T18:45:28","modified_gmt":"2026-08-26T18:45:28","slug":"inline-html-in-shortcode-titles-now-escaped","status":"publish","type":"topic","link":"https:\/\/wordpress.org\/support\/topic\/inline-html-in-shortcode-titles-now-escaped\/","title":{"rendered":"Inline HTML in shortcode titles now escaped"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Hi,<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">After the recent update, inline HTML in shortcode title attributes renders as literal text instead of markup.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Before:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&#091;toggle title=\"&lt;strong&gt;Accounting&lt;\/strong&gt;\"]<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">rendered a bold accordion title.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Now:<\/strong> the same shortcode outputs <code>&amp;lt;strong&amp;gt;Accounting&amp;lt;\/strong&amp;gt;<\/code> as visible text.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Cause<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In <code>includes\/class-ebs-sanitizer.php<\/code>, <code>Sanitizer::html()<\/code> is a direct wrapper around <code>esc_html()<\/code>. It&#8217;s called on ~10 title\/label attributes across the shortcodes:<\/p>\n\n\n\n<ul>\n<li><code>shortcode\/toggles\/plugin_shortcode.php:53<\/code> \u2014 <code>title<\/code><\/li>\n\n\n\n<li><code>shortcode\/tabs\/plugin_shortcode.php:53<\/code> \u2014 <code>title<\/code><\/li>\n\n\n\n<li><code>shortcode\/buttons\/plugin_shortcode.php:25<\/code> \u2014 <code>title<\/code><\/li>\n\n\n\n<li><code>shortcode\/slider\/plugin_shortcode.php:137,139<\/code> \u2014 <code>title<\/code>, <code>caption<\/code><\/li>\n\n\n\n<li><code>shortcode\/progressbar\/plugin_shortcode.php:27<\/code> \u2014 <code>label<\/code><\/li>\n\n\n\n<li><code>shortcode\/servicebox\/plugin_shortcode.php:50,54<\/code> \u2014 <code>heading<\/code>, <code>readmore_text<\/code><\/li>\n\n\n\n<li><code>shortcode\/badge\/plugin_shortcode.php:37<\/code> \u2014 <code>value<\/code><\/li>\n\n\n\n<li><code>shortcode\/oscpopover\/plugin_shortcode.php:68<\/code> \u2014 <code>button_text<\/code><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">I understand the escaping was added as XSS hardening, and I&#8217;m not asking you to drop it. But <code>esc_html()<\/code> is stricter than necessary for these fields, and it silently breaks existing content on every site that used inline formatting in titles.<\/p>\n","protected":false},"template":"","class_list":["post-19003911","topic","type-topic","status-publish","hentry"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/19003911","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":0,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/19003911\/revisions"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=19003911"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}