webfuse

Hi, we’re using this plugin but the recent update broke the functionality. The wp_kses function has the option to customize the allowd protocols. https://developer.ww.wp.xz.cn/reference/functions/wp_kses/

I would suggest adding a sanitize function with the custom rules.

function aFhfc_sanitize_code($value) {
    $allowed = wp_kses_allowed_html('post');
    $allowed['script'] = array('src' => true, 'type' => true, 'async' => true, 'defer' => true);
    $allowed['style']  = array('type' => true, 'media' => true);
    return wp_kses($value, $allowed);
 }

After this the function can be used as the sanitize callback in the register_meta function.

sanitize_callback' => 'aFhfc_sanitize_code

For full control of which tags and attributes are allowed change the sanitize function to the following.

function aFhfc_sanitize_code($value) {
    $allowed = array(
        'script'   => array('src' => true, 'type' => true, 'async' => true, 'defer' => true, 'id' => true, 'crossorigin' => true),
        'noscript' => array(),
        'style'    => array('type' => true, 'media' => true, 'id' => true),
        'link'     => array('rel' => true, 'href' => true, 'type' => true, 'media' => true, 'crossorigin' => true),
        'meta'     => array('name' => true, 'content' => true, 'property' => true, 'charset' => true, 'http-equiv' => true),
        'iframe'   => array('src' => true, 'width' => true, 'height' => true, 'style' => true, 'frameborder' => true, 'allow' => true),
        'img'      => array('src' => true, 'alt' => true, 'width' => true, 'height' => true),
    );
    return wp_kses($value, $allowed);
}

I would recommend using the first option as this extends the current functionality and adds extra excemptions for style and script. I think these tags are very commonly used with the plugin and are now broken.