diff --git a/includes/class-sp-ajax.php b/includes/class-sp-ajax.php index 5edf9f02..ca6080a3 100644 --- a/includes/class-sp-ajax.php +++ b/includes/class-sp-ajax.php @@ -554,7 +554,7 @@ class SP_AJAX { formats->event as $key => $format ): ?> - + @@ -634,7 +634,7 @@ class SP_AJAX { $field_id = 'columns'; ?> $label ): ?> - +

@@ -761,7 +761,7 @@ class SP_AJAX { formats->event as $key => $format ): ?> - + @@ -898,7 +898,7 @@ class SP_AJAX { $field_id = 'columns'; ?> - +

@@ -1152,7 +1152,7 @@ class SP_AJAX { - +

diff --git a/includes/class-sp-countries.php b/includes/class-sp-countries.php index a3c00e3b..b56ddb17 100644 --- a/includes/class-sp-countries.php +++ b/includes/class-sp-countries.php @@ -748,9 +748,9 @@ class SP_Countries { public function country_dropdown_options( $selected_country = '', $escape = false ) { if ( $this->continents ) foreach ( $this->continents as $continent => $countries ): ?> - + $country ): ?> - + ' : $wrapper['before']; $after = empty( $wrapper['after'] ) ? '' : $wrapper['after']; - echo $before; + echo esc_html( $before ); call_user_func( $function, $atts ); - echo $after; + echo esc_html( $after ); return ob_get_clean(); } diff --git a/includes/class-sp-template-loader.php b/includes/class-sp-template-loader.php index 9c3a2422..bf33b81e 100644 --- a/includes/class-sp-template-loader.php +++ b/includes/class-sp-template-loader.php @@ -80,7 +80,7 @@ class SP_Template_Loader { // Render the template echo '

'; if ( 'content' === $key ) { - echo $content; + echo wp_kses_post( $content ); // Template content hook do_action( 'sportspress_single_' . $type . '_content' ); } else {