Ticket #9753: t9753-strip-tags-cat-desc-title-attribute.diff

wp-includes/classes.php

@@ -1331 +1331 @@
                 if ( $use_desc_for_title == 0 || empty($category->description) )
                         $link .= 'title="' . sprintf(__( 'View all posts filed under %s' ), $cat_name) . '"';
                 else
-                        $link .= 'title="' . esc_attr( apply_filters( 'category_description', $category->description, $category )) . '"';
+                        $link .= 'title="' . esc_attr( strip_tags( apply_filters( 'category_description', $category->description, $category ) ) ) . '"';
                 $link .= '>';
                 $link .= $cat_name . '</a>';