From 948a260e805f11709cd38bf305a3092070ec7f66 Mon Sep 17 00:00:00 2001
From: Sergey Biryukov <sergeybiryukov.ru@gmail.com>
Date: Mon, 14 Nov 2022 11:50:15 +0000
Subject: [PATCH] Administration: Add missing escaping for a few strings used
 as HTML attributes.

Follow-up to [47209], [50997], [51006].

Props kowsar89, riccardodicurti, audrasjb, krupalpanchal, SergeyBiryukov.
Fixes #57093.
Built from https://develop.svn.wordpress.org/trunk@54834


git-svn-id: http://core.svn.wordpress.org/trunk@54386 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-admin/includes/nav-menu.php | 2 +-
 wp-admin/nav-menus.php         | 2 +-
 wp-admin/widgets-form.php      | 2 +-
 wp-includes/version.php        | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/wp-admin/includes/nav-menu.php b/wp-admin/includes/nav-menu.php
index ad8b04cff6..0e09d31148 100644
--- a/wp-admin/includes/nav-menu.php
+++ b/wp-admin/includes/nav-menu.php
@@ -524,7 +524,7 @@ function wp_nav_menu_item_post_type_meta_box( $data_object, $box ) {
 			</li>
 		</ul><!-- .posttype-tabs -->
 
-		<div id="tabs-panel-posttype-<?php echo $post_type_name; ?>-most-recent" class="tabs-panel <?php echo ( 'most-recent' === $current_tab ? 'tabs-panel-active' : 'tabs-panel-inactive' ); ?>" role="region" aria-label="<?php _e( 'Most Recent' ); ?>" tabindex="0">
+		<div id="tabs-panel-posttype-<?php echo $post_type_name; ?>-most-recent" class="tabs-panel <?php echo ( 'most-recent' === $current_tab ? 'tabs-panel-active' : 'tabs-panel-inactive' ); ?>" role="region" aria-label="<?php esc_attr_e( 'Most Recent' ); ?>" tabindex="0">
 			<ul id="<?php echo $post_type_name; ?>checklist-most-recent" class="categorychecklist form-no-clear">
 				<?php
 				$recent_args    = array_merge(
diff --git a/wp-admin/nav-menus.php b/wp-admin/nav-menus.php
index e95bb68a90..28dbc8219f 100644
--- a/wp-admin/nav-menus.php
+++ b/wp-admin/nav-menus.php
@@ -1040,7 +1040,7 @@ require_once ABSPATH . 'wp-admin/admin-header.php';
 										<input type="checkbox" id="bulk-select-switcher-bottom" name="bulk-select-switcher-top" class="bulk-select-switcher">
 										<span class="bulk-select-button-label"><?php _e( 'Bulk Select' ); ?></span>
 									</label>
-									<input type="button" class="deletion menu-items-delete disabled" value="<?php _e( 'Remove Selected Items' ); ?>">
+									<input type="button" class="deletion menu-items-delete disabled" value="<?php esc_attr_e( 'Remove Selected Items' ); ?>">
 									<div id="pending-menu-items-to-delete">
 										<p><?php _e( 'List of menu items selected for deletion:' ); ?></p>
 										<ul></ul>
diff --git a/wp-admin/widgets-form.php b/wp-admin/widgets-form.php
index df4efdba90..33f052ee47 100644
--- a/wp-admin/widgets-form.php
+++ b/wp-admin/widgets-form.php
@@ -332,7 +332,7 @@ if ( isset( $_GET['editwidget'] ) && $_GET['editwidget'] ) {
 	<div class="widget-control-actions">
 		<div class="alignleft">
 			<?php if ( ! isset( $_GET['addnew'] ) ) : ?>
-				<input type="submit" name="removewidget" id="removewidget" class="button-link button-link-delete widget-control-remove" value="<?php _e( 'Delete' ); ?>" />
+				<input type="submit" name="removewidget" id="removewidget" class="button-link button-link-delete widget-control-remove" value="<?php esc_attr_e( 'Delete' ); ?>" />
 				<span class="widget-control-close-wrapper">
 					| <a href="widgets.php" class="button-link widget-control-close"><?php _e( 'Cancel' ); ?></a>
 				</span>
diff --git a/wp-includes/version.php b/wp-includes/version.php
index acc4519fec..af6b720b82 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '6.2-alpha-54833';
+$wp_version = '6.2-alpha-54834';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.