Ticket #30967: 30967.diff

src/wp-includes/formatting.php

@@ -1350 +1350 @@
         //Limit to A-Z,a-z,0-9,_,-
         $sanitized = preg_replace( '/[^A-Za-z0-9_-]/', '', $sanitized );
 
-        if ( '' == $sanitized )
-                $sanitized = $fallback;
+        if ( '' == $sanitized ) {
+                $sanitized = preg_replace( '|%[a-fA-F0-9][a-fA-F0-9]|', '', $fallback );
+                $sanitized = preg_replace( '/[^A-Za-z0-9_-]/', '', $sanitized );
+        }
 
         /**
          * Filter a sanitized HTML class string.