Ticket #48549: 48549.diff

src/wp-includes/kses.php

@@ -1152 +1152 @@
  * @return bool Whether or not the attribute is allowed.
  */
 function wp_kses_attr_check( &$name, &$value, &$whole, $vless, $element, $allowed_html ) {
+        if ( ! isset( $allowed_html[ strtolower( $element ) ] ) ) {
+                $name  = '';
+                $value = '';
+                $whole = '';
+                return false;
+        }
+
         $allowed_attr = $allowed_html[ strtolower( $element ) ];
 
         $name_low = strtolower( $name );