Ticket #20476: 20500-avoid-xss-fix.diff

wp-content/themes/twentyeleven/content-single.php

@@ -57 +57 @@
                                 <?php echo get_avatar( get_the_author_meta( 'user_email' ), apply_filters( 'twentyeleven_author_bio_avatar_size', 68 ) ); ?>
                         </div><!-- #author-avatar -->
                         <div id="author-description">
-                                <h2><?php printf( __( 'About %s', 'twentyeleven' ), get_the_author() ); ?></h2>
+                                <h2><?php echo esc_html( sprintf( __( 'About %s', 'twentyeleven' ), get_the_author() ) ); ?></h2>
                                 <?php the_author_meta( 'description' ); ?>
                                 <div id="author-link">
                                         <a href="<?php echo esc_url( get_author_posts_url( get_the_author_meta( 'ID' ) ) ); ?>" rel="author">