From 7ae9a7346445c83ee66be9061e356596c32e79be Mon Sep 17 00:00:00 2001
From: Brad Parbs <brad@bradparbs.com>
Date: Tue, 15 Jun 2021 17:19:23 -0500
Subject: [PATCH] Add escaping to get_the_password_form()

---
 template-parts/content-password-protected.php | 23 +++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

diff --git a/template-parts/content-password-protected.php b/template-parts/content-password-protected.php
index a4d757396..2bc310453 100644
--- a/template-parts/content-password-protected.php
+++ b/template-parts/content-password-protected.php
@@ -16,8 +16,27 @@
 
 		<div class="entry-content">
 			<?php
-				 // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
-				echo get_the_password_form();
+			echo wp_kses(
+				get_the_password_form(),
+				[
+					'p'     => [],
+					'label' => [
+						'for' => [],
+					],
+					'form'  => [
+						'action' => [],
+						'class'  => [],
+						'method' => [],
+					],
+					'input' => [
+						'id'    => [],
+						'name'  => [],
+						'size'  => [],
+						'type'  => [],
+						'value' => [],
+					],
+				]
+			);
 			?>
 		</div><!-- .entry-content -->