Ticket #44880: 44880.diff

src/wp-includes/class-walker-category.php

@@ -146 +146 @@
                         if ( empty( $args['feed_image'] ) ) {
                                 $link .= $name;
                         } else {
-                                $link .= "<img src='" . $args['feed_image'] . "'$alt" . ' />';
+                                $link .= "<img src='" . esc_url( $args['feed_image'] ) . "'$alt" . ' />';
                         }
                         $link .= '</a>';
 
@@ -203 +203 @@
                          * @param int    $depth       Depth of page, used for padding.
                          * @param array  $args        An array of wp_list_categories() arguments.
                          */
-                        $css_classes = implode( ' ', apply_filters( 'category_css_class', $css_classes, $category, $depth, $args ) );
+                        $css_classes = implode( ' ', array_map( 'sanitize_html_class', apply_filters( 'category_css_class', $css_classes, $category, $depth, $args ) ) );
 
                         $output .= ' class="' . $css_classes . '"';
                         $output .= ">$link\n";