diff --git a/wp-admin/plugins.php b/wp-admin/plugins.php index e8984d8ce3..a275fa2773 100644 --- a/wp-admin/plugins.php +++ b/wp-admin/plugins.php @@ -105,7 +105,15 @@ if (empty($plugins)) { } else { $toggle = "".__('Activate').""; } - $plugin_data['Description'] = wp_kses($plugin_data['Description'], array('a' => array('href' => array(),'title' => array()),'abbr' => array('title' => array()),'acronym' => array('title' => array()),'code' => array(),'em' => array(),'strong' => array()) ); ; + + $plugins_allowedtags = array('a' => array('href' => array(),'title' => array()),'abbr' => array('title' => array()),'acronym' => array('title' => array()),'code' => array(),'em' => array(),'strong' => array()); + + // Sanitize all displayed data + $plugin_data['Title'] = wp_kses($plugin_data['Title'], $plugins_allowedtags); + $plugin_data['Version'] = wp_kses($plugin_data['Version'], $plugins_allowedtags); + $plugin_data['Description'] = wp_kses($plugin_data['Description'], $plugins_allowedtags); + $plugin_data['Author'] = wp_kses($plugin_data['Author'], $plugins_allowedtags); + if ( $style != '' ) $style = 'class="' . $style . '"'; if ( is_writable(ABSPATH . 'wp-content/plugins/' . $plugin_file) )