Escape output vars of includes files (#1)

2021-11-06 12:34:49 +02:00
parent 0c9a9dc104
commit e24a9fa4eb
4 changed files with 10 additions and 10 deletions
--- a/includes/class-sp-template-loader.php
+++ b/includes/class-sp-template-loader.php
@@ -80,7 +80,7 @@ class SP_Template_Loader {
 				// Render the template
 				echo '<div class="sp-section-content sp-section-content-' . $key . '">';
 				if ( 'content' === $key ) {
-					echo $content;
+					echo wp_kses_post( $content );
 					// Template content hook
 					do_action( 'sportspress_single_' . $type . '_content' );
 				} else {