Ticket #54277: 54277.diff

src/wp-admin/theme-install.php

@@ -228 +228 @@
                         echo '<div class="filter-group-feature">';
                         foreach ( $features as $feature => $feature_name ) {
                                 $feature = esc_attr( $feature );
+                                $feature_name = esc_html( $feature_name );
                                 echo '<input type="checkbox" id="filter-id-' . $feature . '" value="' . $feature . '" /> ';
                                 echo '<label for="filter-id-' . $feature . '">' . $feature_name . '</label>';
                         }