Missing escaping for XML error message

[maheshpatel]

• File: ​src/wp-trackback.php
• Line: 37
• Problem: $error_message output in XML without escaping

Current Code:

  if ( $error ) {
      echo '<?xml version="1.0" encoding="utf-8"?' . ">\n";
      echo "<response>\n";
      echo "<error>1</error>\n";
      echo "<message>$error_message</message>\n";
      echo '</response>';
  }

Fix:

  if ( $error ) {
      echo '<?xml version="1.0" encoding="utf-8"?' . ">\n";
      echo "<response>\n";
      echo "<error>1</error>\n";
      echo "<message>" . esc_html ( $error_message ) . "</message>\n";
      echo '</response>';
  }

Why It Matters:

• XML special characters (&, <, >) can break XML parsing
• Error messages come from user actions or system states

Add escaping [src/wp-trackback.php#L37 src/wp-trackback.php]

if ( $error ) {

echo '<?xml version="1.0" encoding="utf-8"?' . ">\n";
echo "<response>\n";
echo "<error>1</error>\n";
echo "<message>" . esc_html ( $error_message ) . "</message>\n";
echo '</response>';

}

[maheshpatel]

This issue has been resolved and generated PR
PR - ​https://github.com/WordPress/wordpress-develop/pull/11527

[sabernhardt]

The trackback_response() function has been available since changeset 8, and the escaping functions were added later.

Would esc_xml() be a better choice?