| @@ -17,8 +17,10 @@ | ||
| 17 | 17 | }, 10, 3 ); |
| 18 | 18 | } |
| 19 | 19 | |
| 20 | 20 | public function render( $value ) { |
| 21 | + // the description is plugin-defined text (settings arrays), read once for output | |
| 22 | + $description = (string) ( $value['desc'] ?? '' ); | |
| 21 | 23 | if ( ! isset( $value['id'] ) ) { |
| 22 | 24 | $value['id'] = ''; |
| 23 | 25 | } |
| 24 | 26 | |
| @@ -77,9 +79,9 @@ | ||
| 77 | 79 | <?php endif; ?> |
| 78 | 80 | |
| 79 | 81 | <p class="description"> |
| 80 | 82 | <?php |
| 81 | - echo wp_kses_post( $value['desc'] ); // audit.php.wp.security.xss.shortcode-attr ignore | |
| 83 | + echo wp_kses_post( $description ); // nosemgrep | |
| 82 | 84 | ?> |
| 83 | 85 | </p> |
| 84 | 86 | |
| 85 | 87 | </div> |
