| @@ -1,8 +1,8 @@ | ||
| 1 | 1 | <?php |
| 2 | 2 | /** |
| 3 | 3 | * @package FireBox |
| 4 | - * @version 3.1.9 Free | |
| 4 | + * @version 3.1.14 Free | |
| 5 | 5 | * |
| 6 | 6 | * @author FirePlugins <[email protected]> |
| 7 | 7 | * @link https://www.fireplugins.com |
| 8 | 8 | * @copyright Copyright © 2026 FirePlugins All Rights Reserved |
| @@ -97,9 +97,14 @@ | ||
| 97 | 97 | return $field->prepareValueHTML($meta_item->meta_value); |
| 98 | 98 | } |
| 99 | 99 | else |
| 100 | 100 | { |
| 101 | - return nl2br($meta_item->meta_value); | |
| 101 | + /** | |
| 102 | + * The field no longer exists in the form, so there is no field class to | |
| 103 | + * escape the value for us. Escape here instead — stored values predate | |
| 104 | + * any given sanitization rule and must not be trusted at render time. | |
| 105 | + */ | |
| 106 | + return nl2br(esc_html($meta_item->meta_value)); | |
| 102 | 107 | } |
| 103 | 108 | } |
| 104 | 109 | |
| 105 | 110 | return ''; |
