Ticket #26115: 26115.patch

src/wp-admin/includes/class-wp-ms-users-list-table.php

@@ -16 +16 @@
         function prepare_items() {
                 global $usersearch, $role, $wpdb, $mode;
 
-                $usersearch = isset( $_REQUEST['s'] ) ? $_REQUEST['s'] : '';
+                $usersearch = isset( $_REQUEST['s'] ) ? wp_unslash( trim( $_REQUEST['s'] ) ) : '';
 
                 $users_per_page = $this->get_items_per_page( 'users_network_per_page' );
 

src/wp-admin/includes/class-wp-users-list-table.php

@@ -35 +35 @@
         function prepare_items() {
                 global $role, $usersearch;
 
-                $usersearch = isset( $_REQUEST['s'] ) ? trim( $_REQUEST['s'] ) : '';
+                $usersearch = isset( $_REQUEST['s'] ) ? wp_unslash( trim( $_REQUEST['s'] ) ) : '';
 
                 $role = isset( $_REQUEST['role'] ) ? $_REQUEST['role'] : '';