From 621674572163d202f86028ba21c6f81b695a9a14 Mon Sep 17 00:00:00 2001
From: Sainath Poojary <spoojary614@gmail.com>
Date: Fri, 19 Jun 2026 00:06:59 +0530
Subject: [PATCH] Administration: Improve output escaping in template.php

---
 src/wp-admin/includes/template.php | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/src/wp-admin/includes/template.php b/src/wp-admin/includes/template.php
index a24aae32cc8dd..65ff5fc7f4d2c 100644
--- a/src/wp-admin/includes/template.php
+++ b/src/wp-admin/includes/template.php
@@ -591,8 +591,8 @@ function list_meta( $meta ) {
 <table id="list-table" style="display: none;">
 	<thead>
 	<tr>
-		<th class="left">' . _x( 'Name', 'meta name' ) . '</th>
-		<th>' . __( 'Value' ) . '</th>
+		<th class="left">' . esc_html_x( 'Name', 'meta name' ) . '</th>
+		<th>' . esc_html__( 'Value' ) . '</th>
 	</tr>
 	</thead>
 	<tbody id="the-list" data-wp-lists="list:meta">
@@ -606,8 +606,8 @@ function list_meta( $meta ) {
 <table id="list-table">
 	<thead>
 	<tr>
-		<th class="left"><?php _ex( 'Name', 'meta name' ); ?></th>
-		<th><?php _e( 'Value' ); ?></th>
+		<th class="left"><?php echo esc_html_x( 'Name', 'meta name' ); ?></th>
+		<th><?php echo esc_html__( 'Value' ); ?></th>
 	</tr>
 	</thead>
 	<tbody id='the-list' data-wp-lists='list:meta'>
@@ -1040,7 +1040,7 @@ function wp_import_upload_form( $action ) {
 		?>
 <input type="file" id="upload" name="import" size="25" />
 <input type="hidden" name="action" value="save" />
-<input type="hidden" name="max_file_size" value="<?php echo $bytes; ?>" />
+<input type="hidden" name="max_file_size" value="<?php echo (int) $bytes; ?>" />
 </p>
 		<?php submit_button( __( 'Upload file and import' ), 'primary' ); ?>
 </form>
@@ -1385,7 +1385,7 @@ function do_meta_boxes( $screen, $context, $data_object ) {
 							__( 'Warning:' ) .
 						' </span>';
 					}
-					echo $box['title'];
+					echo esc_html( $box['title'] );
 					echo "</h2>\n";
 
 					if ( 'dashboard_browser_nag' !== $box['id'] ) {
@@ -1778,7 +1778,7 @@ function do_settings_sections( $page ) {
 
 		if ( $section['title'] ) {
 			$unique_id = wp_unique_id( 'wp-settings-section-' . $section['id'] . '-' );
-			echo '<h2 id="' . esc_attr( $unique_id ) . '">' . $section['title'] . "</h2>\n";
+			echo '<h2 id="' . esc_attr( $unique_id ) . '">' . esc_html( $section['title'] ) . "</h2>\n";
 		}
 
 		if ( $section['callback'] ) {
@@ -1828,9 +1828,9 @@ function do_settings_fields( $page, $section ) {
 		echo "<tr{$class}>";
 
 		if ( ! empty( $field['args']['label_for'] ) ) {
-			echo '<th scope="row"><label for="' . esc_attr( $field['args']['label_for'] ) . '">' . $field['title'] . '</label></th>';
+			echo '<th scope="row"><label for="' . esc_attr( $field['args']['label_for'] ) . '">' . esc_html( $field['title'] ) . '</label></th>';
 		} else {
-			echo '<th scope="row">' . $field['title'] . '</th>';
+			echo '<th scope="row">' . esc_html( $field['title'] ) . '</th>';
 		}
 
 		echo '<td>';
@@ -2013,7 +2013,7 @@ function settings_errors( $setting = '', $sanitize = false, $hide_on_update = fa
 		);
 
 		$output .= "<div id='$css_id' class='$css_class'> \n";
-		$output .= "<p><strong>{$details['message']}</strong></p>";
+		$output .= '<p><strong>' . wp_kses_post( $details['message'] ) . '</strong></p>';
 		$output .= "</div> \n";
 	}
 
@@ -2137,7 +2137,7 @@ function iframe_header( $title = '', $deprecated = false ) {
 	header( 'Content-Type: ' . get_option( 'html_type' ) . '; charset=' . get_option( 'blog_charset' ) );
 	_wp_admin_html_begin();
 	?>
-<title><?php bloginfo( 'name' ); ?> &rsaquo; <?php echo $title; ?> &#8212; <?php _e( 'WordPress' ); ?></title>
+<title><?php bloginfo( 'name' ); ?> &rsaquo; <?php echo esc_html( $title ); ?> &#8212; <?php _e( 'WordPress' ); ?></title>
 	<?php
 	wp_enqueue_style( 'colors' );
 
@@ -2215,7 +2215,7 @@ function tb_close() {
 	?>
 </head>
 	<?php
-	$admin_body_id = isset( $body_id ) ? 'id="' . $body_id . '" ' : '';
+	$admin_body_id = isset( $body_id ) ? 'id="' . esc_attr( $body_id ) . '" ' : '';
 
 	/** This filter is documented in wp-admin/admin-header.php */
 	$admin_body_classes = apply_filters( 'admin_body_class', '' );
@@ -2303,7 +2303,7 @@ function _post_states( $post, $display = true ) {
 
 			$suffix = ( $i < $state_count ) ? $separator : '';
 
-			$post_states_html .= "<span class='post-state'>{$state}{$suffix}</span>";
+			$post_states_html .= '<span class="post-state">' . esc_html( $state ) . esc_html( $suffix ) . '</span>';
 		}
 	}
 
@@ -2431,7 +2431,7 @@ function _media_states( $post, $display = true ) {
 
 			$suffix = ( $i < $state_count ) ? $separator : '';
 
-			$media_states_string .= "<span class='post-state'>{$state}{$suffix}</span>";
+			$media_states_string .= '<span class="post-state">' . esc_html( $state ) . esc_html( $suffix ) . '</span>';
 		}
 	}