| @@ -40,9 +40,15 @@ | ||
| 40 | 40 | |
| 41 | 41 | $prefix = $options['keyword_ident']; |
| 42 | 42 | |
| 43 | 43 | // Only act on meta keys that belong to this plugin. |
| 44 | - if ( substr( $meta_key, 0, strlen( $prefix ) ) !== $prefix ) { | |
| 44 | + if ( 0 !== stripos( $meta_key, $prefix ) ) { | |
| 45 | + return $check; | |
| 46 | + } | |
| 47 | + | |
| 48 | + // wp_kses_post() only accepts strings. A non-string value (e.g. an array) is not embed | |
| 49 | + // markup and is neutralized on output, so let the write proceed without sanitizing here. | |
| 50 | + if ( ! is_string( $meta_value ) ) { | |
| 45 | 51 | return $check; |
| 46 | 52 | } |
| 47 | 53 | |
| 48 | 54 | // Strip dangerous markup while preserving safe HTML. |
