| @@ -158,8 +158,12 @@ | ||
| 158 | 158 | 'sandbox' => true, |
| 159 | 159 | ]; |
| 160 | 160 | } |
| 161 | 161 | |
| 162 | + // Strip <script>/<style> incl. contents; wp_kses keeps their inner text otherwise. | |
| 163 | + $html = preg_replace('#<(script|style)\b[^>]*>.*?</\1>#is', '', $html); | |
| 164 | + $html = preg_replace('#<(script|style)\b[^>]*/?>#i', '', $html); | |
| 165 | + | |
| 162 | 166 | return wp_kses($html, $allowed, ['https']); |
| 163 | 167 | } |
| 164 | 168 | |
| 165 | 169 | public function getInfoFromRemoteUrl($url) |
