Ticket #56117: 56117.patch

wp-includes/rest-api/endpoints/class-wp-rest-widget-types-controller.php

@@ -640 +640 @@
                                 $block    = $registry->get_registered( 'core/legacy-widget' );
                                 echo $block->render(
                                         array(
-                                                'idBase'   => $id_base,
-                                                'instance' => $instance,
+                                                'idBase'   => esc_html( $id_base ),
+                                                'instance' => esc_html( $instance ),
                                         )
                                 );
                                 ?>