| @@ -95,9 +95,9 @@ | ||
| 95 | 95 | } |
| 96 | 96 | |
| 97 | 97 | // Skip Elementor editor — $_GET['action'] is set before plugins_loaded |
| 98 | 98 | // and is the most reliable way to detect the Elementor edit screen. |
| 99 | - if ( isset( $_GET['action'] ) && 'elementor' === $_GET['action'] ) { | |
| 99 | + if ( isset( $_GET['action'] ) && 'elementor' === sanitize_key( wp_unslash( $_GET['action'] ) ) ) { | |
| 100 | 100 | return; |
| 101 | 101 | } |
| 102 | 102 | |
| 103 | 103 | // Admin: whitelist pages where the block editor can be active. |
