Ticket #60324: 60324.2.patch

src/wp-includes/class-wp-customize-control.php

@@ -553 +553 @@
                                 <select id="<?php echo esc_attr( $input_id ); ?>" <?php echo $describedby_attr; ?> <?php $this->link(); ?>>
                                         <?php
                                         foreach ( $this->choices as $value => $label ) {
-                                                echo '<option value="' . esc_attr( $value ) . '"' . selected( $this->value(), $value, false ) . '>' . $label . '</option>';
+                                                echo '<option value="' . esc_attr( $value ) . '"' . selected( $this->value(), $value, false ) . '>' . esc_html( $label ) . '</option>';
                                         }
                                         ?>
                                 </select>

src/wp-includes/customize/class-wp-customize-nav-menu-location-control.php

@@ -77 +77 @@
                         <select <?php $this->link(); ?>>
                                 <?php
                                 foreach ( $this->choices as $value => $label ) :
-                                        echo '<option value="' . esc_attr( $value ) . '"' . selected( $this->value(), $value, false ) . '>' . $label . '</option>';
+                                        echo '<option value="' . esc_attr( $value ) . '"' . selected( $this->value(), $value, false ) . '>' . esc_html( $label ) . '</option>';
                                 endforeach;
                                 ?>
                         </select>