diff --git a/wp-modules/editor/editor.php b/wp-modules/editor/editor.php index ab03c022e..18821f978 100644 --- a/wp-modules/editor/editor.php +++ b/wp-modules/editor/editor.php @@ -193,6 +193,7 @@ function disable_autosave() { * Receive pattern id in the URL and display its content. Useful for pattern previews and thumbnails. */ function display_block_pattern_preview() { + // Nonce not required as the user is not taking any action here. if ( ! isset( $_GET['pm_pattern_preview'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended return; } @@ -205,7 +206,7 @@ function display_block_pattern_preview() { wp_head(); - echo $the_content; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped + echo wp_kses_post( $the_content ); wp_footer();