Ticket #28195: 28195.18.patch

src/wp-admin/includes/ajax-actions.php

@@ -2655 +2655 @@
         if ( ! $parsed ) {
                 wp_send_json_error( array(
                         'type' => 'not-embeddable',
-                        'message' => sprintf( __( '%s failed to embed.' ), '<code>' . esc_url( $url ) . '</code>' ),
+                        'message' => sprintf( __( '%s failed to embed.' ), '<code>' . esc_html( $url ) . '</code>' ),
                 ) );
         }
 
@@ -2685 +2685 @@
                 // Admin is ssl and the embed is not. Iframes, scripts, and other "active content" will be blocked.
                 wp_send_json_error( array(
                         'type' => 'not-ssl',
-                        'message' => sprintf( __( 'Preview not available. %s cannot be embedded securely.' ), '<code>' . esc_url( $url ) . '</code>' ),
+                        'message' => sprintf( __( 'Preview not available. %s cannot be embedded securely.' ), '<code>' . esc_html( $url ) . '</code>' ),
                 ) );
         }
 
@@ -2723 +2723 @@
         }
 
         wp_send_json_success( ob_get_clean() );
-}
- No newline at end of file
+}