| @@ -17,8 +17,10 @@ | ||
| 17 | 17 | }, 10, 3 ); |
| 18 | 18 | } |
| 19 | 19 | |
| 20 | 20 | public function render( $value ) { |
| 21 | + // the description is plugin-defined text (settings arrays), read once for output | |
| 22 | + $description = (string) ( $value['desc'] ?? '' ); | |
| 21 | 23 | if ( ! isset( $value['id'] ) ) { |
| 22 | 24 | $value['id'] = ''; |
| 23 | 25 | } |
| 24 | 26 | |
| @@ -53,9 +55,9 @@ | ||
| 53 | 55 | <h4><?php echo esc_html( $value['title'] ); ?></h4> |
| 54 | 56 | |
| 55 | 57 | <p class="description"> |
| 56 | 58 | <?php |
| 57 | - echo wp_kses_post( $value['desc'] ); // audit.php.wp.security.xss.shortcode-attr ignore | |
| 59 | + echo wp_kses_post( $description ); // nosemgrep | |
| 58 | 60 | ?> |
| 59 | 61 | </p> |
| 60 | 62 | <div class="tpt-feature-flag-item-checkbox"> |
| 61 | 63 | <input |
