Ticket #63611: wp_widget_rss_output-html-entities-fix.diff

Index: src/wp-includes/widgets.php
===================================================================
--- src/wp-includes/widgets.php (revision 60000)
+++ src/wp-includes/widgets.php (working copy)
@@
 function wp_widget_rss_output( $rss, $args = array() ) {
        if ( is_string( $rss ) ) {
                $rss = fetch_feed( $rss );
        } elseif ( is_array( $rss ) && isset( $rss['url'] ) ) {
                $args = $rss;
                $rss  = fetch_feed( $rss['url'] );
        }
 
        if ( is_wp_error( $rss ) ) {
                if ( is_admin() || current_user_can( 'manage_options' ) ) {
                        echo '<p>' . sprintf( __( '<strong>RSS Error</strong>: %s' ), $rss->get_error_message() ) . '</p>';
                }
                return;
        }
 
        $default_args = array(
                'show_author'  => 0,
                'show_date'    => 0,
                'show_summary' => 0,
        );
        $args = wp_parse_args( $args, $default_args );
 
        $items = (int) $args['items'];
        if ( $items < 1 || 20 < $items ) {
                $items = 10;
        }
 
        $rss_items = $rss->get_items( 0, $items );
 
        if ( empty( $rss_items ) ) {
                echo '<ul><li>' . __( 'An error has occurred, which probably means the feed is down. Try again later.' ) . '</li></ul>';
                $rss->__destruct();
                unset( $rss );
                return;
        }
 
        echo '<ul>';
        foreach ( $rss_items as $item ) {
-               $title = esc_html( trim( strip_tags( $item->get_title() ) ) );
+               // Decode HTML entities first to avoid showing escaped HTML tags like &lt;em&gt;.
+               $title = esc_html( trim( strip_tags( html_entity_decode( $item->get_title() ) ) ) );
 
                if ( '' === $title ) {
                        $title = __( 'Untitled' );
                }
 
                $link = $item->get_link();
                while ( stristr( $link, 'http' ) !== $link ) {
                        $link = substr( $link, 1 );
                }
                $link = esc_url( strip_tags( $link ) );
 
                $desc = $item->get_description();
                $desc = html_entity_decode( $desc, ENT_QUOTES, get_option( 'blog_charset' ) );
                $desc = esc_attr( wp_trim_words( $desc, 55, ' [&hellip;]' ) );
                $summary = '';
                if ( $args['show_summary'] ) {
                        $summary = $desc;
                }