| @@ -12,9 +12,11 @@ | ||
| 12 | 12 | global $property; |
| 13 | 13 | ?> |
| 14 | 14 | <div class="price"> |
| 15 | 15 | |
| 16 | - <?php echo $property->get_formatted_price(); ?> | |
| 16 | + <?php | |
| 17 | + // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Price producers escape stored values before trusted currency, commercial and propertyhive_price_output HTML filters. | |
| 18 | + echo $property->get_formatted_price(); ?> | |
| 17 | 19 | |
| 18 | 20 | <?php |
| 19 | 21 | if ( $price_qualifier != '' ) |
| 20 | 22 | { |
| @@ -24,9 +26,9 @@ | ||
| 24 | 26 | if ( $fees != '' ) |
| 25 | 27 | { |
| 26 | 28 | echo ' <span class="lettings-fees"><a data-fancybox data-src="#propertyhive_lettings_fees_popup" href="javascript:;">' . esc_html(__( 'Tenancy Info', 'propertyhive' )) . '</a></span>'; |
| 27 | 29 | |
| 28 | - echo '<div id="propertyhive_lettings_fees_popup" style="display:none; max-width:500px;"><h3>' . esc_html(__( 'Tenancy Info', 'propertyhive' )) . '</h3>' . $fees . '</div>'; | |
| 30 | + echo '<div id="propertyhive_lettings_fees_popup" style="display:none; max-width:500px;"><h3>' . esc_html(__( 'Tenancy Info', 'propertyhive' )) . '</h3>' . wp_kses_post( $fees ) . '</div>'; | |
| 29 | 31 | } |
| 30 | 32 | ?> |
| 31 | 33 | |
| 32 | 34 | </div> |
