escape id attr

DotCamp · Jul 10, 2024 · 339d2ee · 339d2ee
1 parent 68402d9
commit 339d2ee
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/extensions/custom-css/class-custom-css.php b/src/extensions/custom-css/class-custom-css.php
@@ -186,7 +186,7 @@ public function ub_render_custom_css($content, $block) {
 			$pattern = '/id=("|\')(.*?)("|\')/i';
 			preg_match($pattern, $matches_first_element[0], $matches);
 			if (!isset($matches[2])) {
-				$updated_content = preg_replace('/(<[^>]+)/', '$1 id="' . $block_id . '"', $content, 1);
+				$updated_content = preg_replace('/(<[^>]+)/', '$1 id="' . esc_attr($block_id) . '"', $content, 1);
 			}
 		}
 		return $updated_content;