From a9e47699a7e01e30db8ce767884f5dbc14156bc0 Mon Sep 17 00:00:00 2001
From: Jb Audras <audrasjb@git.wordpress.org>
Date: Sun, 28 Jan 2024 07:48:15 +0000
Subject: [PATCH] Coding Standards: Add missing escaping functions to
 `WP_Customize_Control` and `WP_Customize_Nav_Menu_Location_Control`.

Follow-up to [20295], [32806].

Props nareshbheda, shailu25, sabernhardt, audrasjb.
Fixes #60324.





git-svn-id: https://develop.svn.wordpress.org/trunk@57369 602fd350-edb4-49c9-b593-d223f7449a82
---
 src/wp-includes/class-wp-customize-control.php                  | 2 +-
 .../customize/class-wp-customize-nav-menu-location-control.php  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/wp-includes/class-wp-customize-control.php b/src/wp-includes/class-wp-customize-control.php
index 30e8c2c639..055f6cf670 100644
--- a/src/wp-includes/class-wp-customize-control.php
+++ b/src/wp-includes/class-wp-customize-control.php
@@ -553,7 +553,7 @@ class WP_Customize_Control {
 				<select id="<?php echo esc_attr( $input_id ); ?>" <?php echo $describedby_attr; ?> <?php $this->link(); ?>>
 					<?php
 					foreach ( $this->choices as $value => $label ) {
-						echo '<option value="' . esc_attr( $value ) . '"' . selected( $this->value(), $value, false ) . '>' . $label . '</option>';
+						echo '<option value="' . esc_attr( $value ) . '"' . selected( $this->value(), $value, false ) . '>' . esc_html( $label ) . '</option>';
 					}
 					?>
 				</select>
diff --git a/src/wp-includes/customize/class-wp-customize-nav-menu-location-control.php b/src/wp-includes/customize/class-wp-customize-nav-menu-location-control.php
index 4877ada9e1..b0340b1eee 100644
--- a/src/wp-includes/customize/class-wp-customize-nav-menu-location-control.php
+++ b/src/wp-includes/customize/class-wp-customize-nav-menu-location-control.php
@@ -77,7 +77,7 @@ class WP_Customize_Nav_Menu_Location_Control extends WP_Customize_Control {
 			<select <?php $this->link(); ?>>
 				<?php
 				foreach ( $this->choices as $value => $label ) :
-					echo '<option value="' . esc_attr( $value ) . '"' . selected( $this->value(), $value, false ) . '>' . $label . '</option>';
+					echo '<option value="' . esc_attr( $value ) . '"' . selected( $this->value(), $value, false ) . '>' . esc_html( $label ) . '</option>';
 				endforeach;
 				?>
 			</select>