Ticket #20125: 20125.diff

wp-admin/includes/template.php

@@ -1266 +1266 @@
 
         $output = '';
         foreach ( $settings_errors as $key => $details ) {
-                $css_id = 'setting-error-' . $details['code'];
-                $css_class = $details['type'] . ' settings-error';
+                $css_id = 'setting-error-' . esc_attr( $details['code'] );
+                $css_class = esc_attr( $details['type'] ) . ' settings-error';
                 $output .= "<div id='$css_id' class='$css_class'> \n";
-                $output .= "<p><strong>{$details['message']}</strong></p>";
+                $output .= "<p><strong>" . wp_kses_data( $details['message'] ) . "</strong></p>";
                 $output .= "</div> \n";
         }
         echo $output;