From d69b60e7caeffe5e713aeb422b59ec9b6c99ca3e Mon Sep 17 00:00:00 2001
From: Jb Audras <audrasjb@git.wordpress.org>
Date: Mon, 6 Feb 2023 21:34:56 +0000
Subject: [PATCH] Coding Standards: Add missing escaping function in
 `Custom_Image_Header::show_header_selector()`.

Props chintan1896, SergeyBiryukov.
Fixes #57638.


git-svn-id: https://develop.svn.wordpress.org/trunk@55240 602fd350-edb4-49c9-b593-d223f7449a82
---
 src/wp-admin/includes/class-custom-image-header.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/wp-admin/includes/class-custom-image-header.php b/src/wp-admin/includes/class-custom-image-header.php
index c8809ade2f..12ac1ef9e2 100644
--- a/src/wp-admin/includes/class-custom-image-header.php
+++ b/src/wp-admin/includes/class-custom-image-header.php
@@ -332,7 +332,7 @@ class Custom_Image_Header {
 			if ( ! empty( $header['attachment_id'] ) ) {
 				$width = ' width="230"';
 			}
-			echo '<img src="' . set_url_scheme( $header_thumbnail ) . '" alt="' . esc_attr( $header_alt_text ) . '"' . $width . ' /></label>';
+			echo '<img src="' . esc_url( set_url_scheme( $header_thumbnail ) ) . '" alt="' . esc_attr( $header_alt_text ) . '"' . $width . ' /></label>';
 			echo '</div>';
 		}