From 0c7ed5445eb62632376dd8a6cf71ade1fc9989d7 Mon Sep 17 00:00:00 2001 From: opurockey Date: Wed, 15 Apr 2026 15:36:14 +0600 Subject: [PATCH] Added escaping on several strings in wp-login.php --- src/wp-login.php | 74 ++++++++++++++++++++++++------------------------ 1 file changed, 37 insertions(+), 37 deletions(-) diff --git a/src/wp-login.php b/src/wp-login.php index abedea82c3589..3d67cd9adafbe 100644 --- a/src/wp-login.php +++ b/src/wp-login.php @@ -94,7 +94,7 @@ function login_header( $title = null, $message = '', $wp_error = null ) { > - <?php echo $login_title; ?> + <?php echo esc_html( $login_title ); ?> -

+

-

+

- + @@ -433,7 +433,7 @@ function login_footer( $input_id = '' ) { ob_start(); ?> - +
@@ -896,7 +896,7 @@ function wp_login_viewport_meta() {

- +

- +

@@ -1044,20 +1044,20 @@ function wp_login_viewport_meta() { -
+
- +

- +

-

+

- +

- +

- +

- +

@@ -1193,15 +1193,15 @@ function wp_login_viewport_meta() {

@@ -1374,7 +1374,7 @@ function wp_login_viewport_meta() { if ( $customize_login ) { ob_start(); ?> - + " method="post">

- - class="input ltr" value="" size="20" autocapitalize="off" autocomplete="username" required="required" /> + + class="input ltr" value="" size="20" autocapitalize="off" autocomplete="username" required="required" />

- +
- class="input password-input ltr" value="" size="20" autocomplete="current-password" spellcheck="false" required="required" /> + class="input password-input ltr" value="" size="20" autocomplete="current-password" spellcheck="false" required="required" /> @@ -1575,15 +1575,15 @@ function wp_login_viewport_meta() { %s', esc_url( wp_registration_url() ), __( 'Register' ) ); + $registration_url = sprintf( '', esc_url( wp_registration_url() ), esc_html__( 'Register' ) ); /** This filter is documented in wp-includes/general-template.php */ - echo apply_filters( 'register', $registration_url ); + echo wp_kses_post( apply_filters( 'register', $registration_url ) ); echo esc_html( $login_link_separator ); } - $html_link = sprintf( '', esc_url( wp_lostpassword_url() ), __( 'Lost your password?' ) ); + $html_link = sprintf( '', esc_url( wp_lostpassword_url() ), esc_html__( 'Lost your password?' ) ); /** * Filters the link that allows the user to reset the lost password. @@ -1592,7 +1592,7 @@ function wp_login_viewport_meta() { * * @param string $html_link HTML link to the lost password form. */ - echo apply_filters( 'lost_password_html_link', $html_link ); + echo wp_kses_post( apply_filters( 'lost_password_html_link', $html_link ) ); ?>