Yep. I’m afraid you’ve used a deprecated feature to fix the issue with the get_klaviyo_option() function…
Please, consider replacing
return $filter_var($option_value, FILTER_SANITIZE_STRING);
with the following code
$option_value = preg_replace('/\x00|<[^>]*>?/', '', $option_value);
return str_replace(["'", '"'], [''', '"'], $option_value);
Thanks. However, I have not done anything. My question was more in the line of are you (the devs of the plugin) going to fix this soon in an upcomming patch/version?
Sorry for the misunderstanding. With “You” I meant the plugin developers 😉
I’m also affected by this bug!
Thanks to you both for reporting this and thanks David for the fix suggestion. We will be working on getting this updated!
@officedigitalwrighteu @davefx An update has been released (version 3.0.10) which uses htmlspecialchars to escape the response. Thank you both for bringing this to our attention! If you notice any further issues, please let us know.
-
This reply was modified 3 years, 2 months ago by
klaviyo.