Ticket #55496: 55496.patch

wp-admin/menu-header.php

@@ -123 +123 @@
                  * as special cases.
                  */
                 if ( ! empty( $item[6] ) ) {
-                        $img = '<img src="' . $item[6] . '" alt="" />';
+                        $img = '<img src="' . esc_url( $item[6] ) . '" alt="" />';
 
                         if ( 'none' === $item[6] || 'div' === $item[6] ) {
                                 $img = '<br />';