| @@ -8,8 +8,12 @@ | ||
| 8 | 8 | <div class="betterdocs-social-share-heading"> |
| 9 | 9 | <?php |
| 10 | 10 | if ( $title ) { |
| 11 | 11 | $title_tag = isset( $title_tag ) ? $title_tag : 'h4'; |
| 12 | + // Allow-list the tag name — esc_attr() does not stop a space/= from | |
| 13 | + // injecting an attribute in this tag-name position (stored XSS via | |
| 14 | + // the shortcode title_tag). | |
| 15 | + $title_tag = betterdocs()->template_helper->is_valid_tag( $title_tag ); | |
| 12 | 16 | echo wp_sprintf( '<%1$s class="betterdocs-social-share-title-tag">%2$s</%1$s>', esc_attr( $title_tag ), esc_html( $title ) ); |
| 13 | 17 | } |
| 14 | 18 | ?> |
| 15 | 19 | </div> |
