Ticket #58831: 58831-add-missing-escape-wp-includes.patch

src/wp-includes/general-template.php

@@ -1299 +1299 @@
                 return;
         }
 
-        echo '<title>' . wp_get_document_title() . '</title>' . "\n";
+        echo '<title>' . esc_html( wp_get_document_title() ) . '</title>' . "\n";
 }
 
 /**

src/wp-includes/load.php

@@ -495 +495 @@
         }
 
         if ( $display ) {
-                echo $r;
+                echo esc_html( $r );
         }
 
         return $r;

src/wp-includes/theme-compat/header.php

@@ -21 +21 @@
 <link rel="profile" href="https://gmpg.org/xfn/11" />
 <meta http-equiv="Content-Type" content="<?php bloginfo( 'html_type' ); ?>; charset=<?php bloginfo( 'charset' ); ?>" />
 
-<title><?php echo wp_get_document_title(); ?></title>
+<title><?php echo esc_html( wp_get_document_title() ); ?></title>
 
 <link rel="stylesheet" href="<?php bloginfo( 'stylesheet_url' ); ?>" type="text/css" media="screen" />
 <link rel="pingback" href="<?php bloginfo( 'pingback_url' ); ?>" />
@@ -54 +54 @@
 
 <div id="header" role="banner">
         <div id="headerimg">
-                <h1><a href="<?php echo home_url(); ?>/"><?php bloginfo( 'name' ); ?></a></h1>
+                <h1><a href="<?php echo esc_url( home_url() ); ?>/"><?php bloginfo( 'name' ); ?></a></h1>
                 <div class="description"><?php bloginfo( 'description' ); ?></div>
         </div>
 </div>