Ticket #27878: 27878.patch

src/wp-includes/default-widgets.php

@@ -1348 +1348 @@
                 <p>
                         <label for="<?php echo $this->get_field_id('nav_menu'); ?>"><?php _e('Select Menu:'); ?></label>
                         <select id="<?php echo $this->get_field_id('nav_menu'); ?>" name="<?php echo $this->get_field_name('nav_menu'); ?>">
+                                <option value=""><?php _e( '--Select--' ) ?></option>
                 <?php
                         foreach ( $menus as $menu ) {
                                 echo '<option value="' . $menu->term_id . '"'
                                         . selected( $nav_menu, $menu->term_id, false )
-                                        . '>'. $menu->name . '</option>';
+                                        . '>'. esc_html( $menu->name ) . '</option>';
                         }
                 ?>
                         </select>