Ping back URL display with out escaping.

[sharaz]

functions.php
Line no 401 : printf( '<link rel="pingback" href="%s">' . "\n", get_bloginfo( 'pingback_url' ) );
According to theme review hand book ​Ref data should be escaped before output.
So the right way.
printf( '<link rel="pingback" href="%s">' . "\n", esc_url( get_bloginfo( 'pingback_url' ) ) );

[sharaz]

I found this issue in twenty seventeen functions.php

[soulseekah]

esc_url on bloginfo pingback URL

[soulseekah]

Welcome to Trac! Thanks for your report. While not a security issue (well, not less secure than the_title()), using esc_url should be done, of course.

43717.diff fixes all 7 themes in this regard.

[pento]

In 44500:

Bundled Themes: Run the pingback_url through esc_url().

Twenties Ten through Seventeen have been updated to properly escape the pingback URL. Twenty Nineteen is already escaping the URL.

Props soulseekah, sharaz.
Fixes #43717.