Ticket #22436: default-widgets.diff

wp-includes/default-widgets.php

@@ -571 +571 @@
                 <ul>
                 <?php while ( $r->have_posts() ) : $r->the_post(); ?>
                         <li>
-                                <a href="<?php the_permalink() ?>" title="<?php echo esc_attr( get_the_title() ? get_the_title() : get_the_ID() ); ?>"><?php if ( get_the_title() ) the_title(); else the_ID(); ?></a>
+                                <a href="<?php the_permalink() ?>" title="<?php echo esc_attr( get_the_title() ? get_the_title() : get_the_ID() ); ?>"><?php if ( get_the_title() ) echo esc_html( get_the_title() ); else esc_html( get_the_ID() ); ?></a>
                         <?php if ( $show_date ) : ?>
                                 <span class="post-date"><?php echo get_the_date(); ?></span>
                         <?php endif; ?>